ci(node.js): update workflow

[Fdawgs]

This PR:

• Removes Git credentials/SSH keys after checkout as a security precaution by setting persist-credentials to false. They are not used after the initial checkout, and this stops them from accidentally leaking through a script
• Declares the minimum permissions for the workflow to run at the job level, following principle of least privilege; see related GitHub security post

[75lb]

thanks 👍