Make CI a little bit safer

[blyxyas]

This PR fixes two vulnerabilities in our CI, found with zizmor. One could be exploited by someone with tag-pushing permissions to execute arbitrary code in our CI (seedeploy.yml). The second vulnerability would expose our tokens to a supply chain attack via a build.rs in one of the dependencies (See the rest of the files, and actions/checkout#485)

Pre-reviewed by @flip1995 in our DMs.

changelog:none

[rustbot]

r? @flip1995

rustbot has assigned @flip1995.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer