ci: audit workflows with zizmor

.github/workflows/repl.yml

@@ -7,6 +7,8 @@ name: Build Windows REPL .exe
 on:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build_repl:
     name: Build REPL example
@@ -15,6 +17,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           show-progress: false
+          persist-credentials: false
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Build