Workflows: harden, update tooling

[airwoodix]

Summary

Various workflows hardening measures, guided by zizmor reports (thanks @wilfried-huss for the hint).

• use persist-credentials: false in actions/checkout. We don't use raw git commands in the steps (so none requires authentication)
• restrict the tag patterns that trigger the docs and release workflows
• for documentation and release, split the workflows into build and release jobs, such that token permissions are only given when strictly necessary
• update Poetry and Python versions in docs and release.