CI: Fixes from zizmor

> A static analysis tool for Github Actions
https://github.com/woodruffw/zizmor

Mostly means adding `persist-credentials: false` to checkouts and replacing `{{ env.VARNAME }}` with shell substitution.

.github/workflows/test-build.yml

@@ -46,6 +46,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-build-env
@@ -89,6 +90,8 @@ jobs:
     steps:
       - name: Checkout Yosys
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-build-env
@@ -115,7 +118,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .local/
-          key: ${{ matrix.os }}-${{ env.IVERILOG_GIT }}
+          key: ${{ matrix.os }}-${IVERILOG_GIT}
 
       - name: Build iverilog
         if: steps.cache-iverilog.outputs.cache-hit != 'true'
@@ -167,6 +170,8 @@ jobs:
     steps:
       - name: Checkout Yosys
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-build-env
@@ -188,7 +193,7 @@ jobs:
       - name: Run tests
         shell: bash
         run: |
-          make -C docs test -j${{ env.procs }}
+          make -C docs test -j$procs
 
   test-docs-build:
     name: Try build docs
@@ -204,6 +209,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Runtime environment
         run: |
@@ -213,7 +219,7 @@ jobs:
         run: |
           make config-clang
           echo "ENABLE_CCACHE := 1" >> Makefile.conf
-          make -j${{ env.procs }}
+          make -j$procs
 
       - name: Install doc prereqs
         shell: bash
@@ -223,7 +229,7 @@ jobs:
       - name: Build docs
         shell: bash
         run: |
-          make docs DOC_TARGET=${{ matrix.docs-target }} -j${{ env.procs }}
+          make docs DOC_TARGET=${{ matrix.docs-target }} -j$procs
 
       - name: Store docs build artifact
         uses: actions/upload-artifact@v4