SEC: address security issues detected with zizmor

[neutrinoceros]

Since these workflows are widely used and even run automated package uploads (e.g. astropy-iers-data), it seems worth hardening their security as much as possible.

I intend to enable zizmor's pre-commit hook in a follow up PR. This first one contains a couple of semi-automated fixes, with each commit focused on a single audit.
There are a couple remaining issues that I'll try to address next, but don't have auto-fixers available.

• SEC: add cooldown period to dependabot settings
• SEC: fix exploitable template-injection surface
• SEC: avoid leaking credentials
• SEC: disable default gha permissions

[neutrinoceros]

to be specific, the main remaining audit is secrets-outside-env, but I'm not sure how/if this can be fixed in the context of re-usable workflows. Basically, I think it is expected that users set the proper protecting envs, but I'm not sure we can enforce it here.

[neutrinoceros]

Not everything works out the box so I think I'm going to split this up to ease iteration and review

[neutrinoceros]

re-issued into smaller PRs. Progress will be tracked in #364