ci: tighten security of checkout action

Author: foosel

.github/workflows/docs.yaml

@@ -55,9 +55,10 @@ jobs:
 
       - name: ⬇ Checkout docs.octoprint.org
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.client_payload.ref == format('refs/{0}/{1}', matrix.source, matrix.version)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: docs.octoprint.org
+          persist-credentials: false
 
       - name: 👀 Determine latest OctoPrint release
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.client_payload.ref == format('refs/{0}/{1}', matrix.source, matrix.version)
@@ -67,7 +68,7 @@ jobs:
 
       - name: 🐍 Set up Python ${{ matrix.python }}
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.client_payload.ref == format('refs/{0}/{1}', matrix.source, matrix.version)
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
 
@@ -93,11 +94,12 @@ jobs:
 
       - name: ⬇ Checkout OctoPrint
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.client_payload.ref == format('refs/{0}/{1}', matrix.source, matrix.version)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: "OctoPrint/OctoPrint"
           ref: ${{ matrix.version }}
           path: OctoPrint
+          persist-credentials: false
 
       - name: 🏗 Install OctoPrint
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.client_payload.ref == format('refs/{0}/{1}', matrix.source, matrix.version)
@@ -138,10 +140,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ⬇ Checkout docs.octoprint.org
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: gh-pages
           path: docs
+          persist-credentials: false
 
       - name: ⬇ Fetch all artifacts
         uses: actions/download-artifact@v4