CI: auto-fix via zizmor

May include:

- Avoids risky string interpolation.
- Prevents checkout premissions from leaking

Author: tacaswell

.github/workflows/update-changelog.yaml

@@ -17,6 +17,7 @@ jobs:
         uses: actions/checkout@v2
         with:
           ref: main
+          persist-credentials: false
 
       - name: Update Changelog
         uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1