[ondrejmirtes]

Fixes everything that the linters in lint-workflows.yml (actionlint, octoscan, poutine, zizmor --persona=auditor) currently report. I ran all four locally with the versions CI uses, and each one now reports nothing.

Real fixes

• actions/checkout gets persist-credentials: false everywhere except create-tag.yml. That workflow keeps the token because rickstaa/action-create-tag pushes the tag with it.
• Workflows that had no permissions: block now get contents: read. release-toot.yml and release-tweet.yml get permissions: {}. Release and tag creation already use PHPSTAN_BOT_TOKEN, so they don't need write access.
• Every workflow now has a concurrency group. Builds use the existing build-${{ github.head_ref || github.run_id }} pattern, so pushes to branches are still never cancelled.
• actionlint used to be installed by piping download-actionlint.bash from main into bash. It's now a pinned v1.7.12 release tarball with a SHA-256 check.
• Matrix values that were interpolated into run: scripts are passed through env: where that's possible (PHPUnit version, platform-test packages).
• The ramsey/composer-install version comment now says 4.0.0, matching the tag the pinned SHA points to.
• Jobs that had no name now have one.

Intentional, suppressed with a justification next to it

• run: ${{ matrix.update-packages }} / ${{ matrix.script }}: the whole script is defined statically in the matrix.
• ./build-infection/... local action: it's cloned at runtime, so the $/ self-repository syntax can't load it. octoscan ignores the build-cs/build-infection custom-ref checkouts and this local action.
• postgres:latest / mysql:latest in platform tests run against the newest database servers on purpose.
• softprops/action-gh-release (superfluous-actions) is kept.
• .github/zizmor.yml allows the release secrets that are stored at repository level (secrets-outside-env).
• .github/poutine.yml skips github_action_from_unverified_creator_used, because every action is SHA-pinned.