Prevents unintended bumps on the flake.lock and Yosys version on forks (provided the forks synchronize their main after this gets merged).
Update version.yml to use the same style of `if` on the job, rather than on specific actions.
Wheels will still build as a cron job, but won't try to upload if it's a fork.
> A static analysis tool for Github Actions
https://github.com/woodruffw/zizmor
Mostly means adding `persist-credentials: false` to checkouts and replacing `{{ env.VARNAME }}` with shell substitution.
