SEC: enabling security scans with zizmor in CI

[neutrinoceros]

the following PRs are preliminary requirements for this

• MNT: drop unneeded third-party GHA softprops/action-gh-release #58
• SEC: disable default gha permissions #64
• SEC: avoid leaking credentials in GHA #65
• SEC: auto-fix a possible template-injection target #66