ci: address zizmor findings

[woodruffw]

This addresses a bunch of findings from zizmor, both low-impact (mostly credential persistence/permission minimization) as well as some potential template injections (non-exploitable in this case, but good to remove!)

I've also gone ahead and bumped the versions on a couple of actions, where they were outdated.

NB: This changeset doesn't include a new workflow for zizmor, but if folks are interested this one should be drag-n-drop 🙂

Afterwards:

$ zizmor .
🌈 completed ci-build.yml
🌈 completed hugo.yml
No findings to report. Good job!