This PR:

• Removes Git credentials/SSH keys after checkout as a security precaution by setting persist-credentials to false, they are not used after the initial checkout
• Declares the minimum permissions for CI workflows to run at the workflow level, following principle of least privilege; see related GitHub security post