ci: few security/permissions improvements
(cherry picked from commit ff6d29717c)
Conflicts:
.github/workflows/main.yml
.github/workflows/prepare-release-pr.yml
.github/workflows/update-plugin-list.yml
scripts/prepare-release-pr.py
scripts/report-coverage.sh