ci: harden workflows per Hypatia security-scan findings

ci: harden workflows per Hypatia security-scan findings #4