chore: Fix pedantic level reports from zizmor

Fix all medium and high level findings

Author: Erethon

.github/workflows/bump.yaml

@@ -8,12 +8,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
-  actions: write
+  {}
 
 jobs:
   update-npins:
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

.github/workflows/codeql.yaml

@@ -10,11 +10,12 @@ on:
 permissions:
   actions: read
   contents: read
-  security-events: write
 
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1