ci: fix zizmor findings

[afuetterer]

What does this PR do?

This PR hardens the CI security a little bit, by running zizmor on the workflow file.

I fixed the following warnings:

• warning[excessive-permissions]: overly broad permissions
• help[artipacked]: credential persistence through GitHub Actions artifacts

Do you additionally want to pin the gha versions, as recommended by zizmor?

• error[unpinned-uses]: unpinned action reference, https://docs.zizmor.sh/audits/#unpinned-uses

Ref: https://docs.zizmor.sh

Before submitting

• This PR fixes a typo or improves the docs (if yes, ignore all other checks!).
• Did you read the contributor guideline?
• Was this discussed/approved via a Github issue? Please add a link to it if that's the case.
• Did you make sure to update the documentation with your changes (if applicable)?
• Did you write any new necessary tests?