setup.cfg: pin setuptools to version before 82 (#701)

This is needed because in version
[82](https://setuptools.pypa.io/en/latest/history.html#v82-0-0),
`pkg_resources` was removed.

Also improve CI configuration/security a bit.

Author: tomponline

.github/dependabot.yml

@@ -5,8 +5,12 @@ updates:
     labels: []
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "pip"
     directory: "/"
     labels: []
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yml

@@ -55,6 +55,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/tests.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
     - name: Repository checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Require GHA pinning
       uses: canonical/lxd/.github/actions/require-gha-pinning@main
@@ -54,6 +56,8 @@ jobs:
     steps:
     - name: Repository checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: |
@@ -84,6 +88,8 @@ jobs:
     steps:
     - name: Repository checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

setup.cfg

@@ -35,7 +35,8 @@ testing =
     requests-mock < 1.2
     # Python 3.12 no longer installs `setuptools` in venv
     # but mock-services depends on it for `pkg_resources`
-    setuptools
+    # `pkg_resources` was removed from `setuptools` 82 so pin an earlier version.
+    setuptools < 82
 format =
     black
     flake8