auto fixes to github actions by zizmor

.github/dependabot.yml

@@ -13,3 +13,5 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -54,6 +54,7 @@ jobs:
               uses: actions/checkout@v5
               with:
                 fetch-depth: 10
+                persist-credentials: false
 
             - name: Install calibre dependencies
               run: setup/arch-ci.sh

.github/workflows/codeql.yml

@@ -42,6 +42,7 @@ jobs:
               # We must fetch at least the immediate parents so that if this is
               # a pull request then we can checkout the head.
               fetch-depth: 2
+              persist-credentials: false
 
         # Initializes the CodeQL tools for scanning.
         - name: Initialize CodeQL