ci: fix zizmor audit findings

[MarshallOfSound]

Fixes zizmor audit findings surfaced in the latest scheduled audit run.

Changes:

• dependabot.yml: add 7-day cooldown for github-actions updates (auto-fix)
• build.yml / test.yml: set persist-credentials: false on actions/checkout (artipacked)
• release.yml: add top-level permissions: {} and explicit contents: read for the reusable test/build job calls (excessive-permissions)

Remaining finding (left as-is):

• dangerous-triggers on add-to-project.yml — pull_request_target is required so the workflow can authenticate as a GitHub App and add newly opened PRs/issues to the Ecosystem WG project board. The workflow only listens for types: opened, runs with permissions: {}, and never checks out PR-controlled code, so the typical pull_request_target risk does not apply.

cc @dsanders11