Secure GHA setup (#299)

Fixes #290.

.github/workflows/tests.yml

@@ -37,6 +37,8 @@ jobs:
     name: ${{ matrix.config[1] }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with:

.meta.toml

@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/pure-python
 [meta]
 template = "pure-python"
-commit-id = "55111d56"
+commit-id = "b5bcf6d7"
 
 [python]
 with-windows = false

src/zope/meta/c-code/tests-cache.j2

@@ -1,5 +1,7 @@
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:

src/zope/meta/default/tests.yml.j2

@@ -90,6 +90,8 @@ jobs:
     %(line)s
 {% endfor %}
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with: