ci: audit workflows with zizmor

.github/workflows/jsonrpc-client-npm-package.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   pack-module:
     name: "Publish @deltachat/jsonrpc-client"
@@ -15,6 +17,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           show-progress: false
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with: