ci: audit workflows with zizmor and fix its findings

[jo16oh]

• Run zizmor in CI and in the pre-commit hook
• Default the workflow token to contents: read, and to no permissions in release.yml
• Set persist-credentials: false on every checkout
• Pass the token only to the step that pushes gh-pages, not to the vp install step before it
• Turn off caching in the release workflow