ci: update workflows

[Fdawgs]

Last PR, I promise!

This PR:

• Removes Git credentials after checkout as a security precaution by setting persist-credentials to false. They are not used after the initial checkout, and this stops them from accidentally leaking through a script; see related GitHub security post and related actions/checkout issue
• Declares the minimum permissions for the workflows to run at the workflow level, following principle of least privilege; see related GitHub security post
• Set check-latest to true, so that the actions/setup-node will check it is using the latest minor or hotfix Node version and use that instead of its cached version, this stops an issue like with 22.5.0 that introduced a regression and actions were still using that instead of 22.5.1
• Updates automerge job to check if the user triggering job is dependabot (same as what Fastify repos do)
• Adds --ignore-scripts arg to npm install calls, preventing any potentially harmful lifecycle scripts that may have snuck in