Address https://docs.zizmor.sh/audits/#artipacked findings.

[cpovirk]

Google has been rolling out zizmor to more of its repos, and zizmor wants persist-credentials: false.

(Gemini leads me to believe that the risk without persist-credentials: false has been minimal since version 6 (actions/checkout#2286?). I haven't tried to verify that. It doesn't seem like the default persist-credentials value is likely to change.)

zizmor also wants us to pin google/oss-fuzz. I posted google/oss-fuzz#6836 (comment).

Purpose

Description

Checklist

• New code follows the Google Java Style Guide
  This is automatically checked by mvn verify, but can also be checked on its own using mvn spotless:check.
  Style violations can be fixed using mvn spotless:apply; this can be done in a separate commit to verify that it did not cause undesired changes.
• If necessary, new public API validates arguments, for example rejects null
• New public API has Javadoc
  • Javadoc uses @since $next-version$
    ($next-version$ is a special placeholder which is automatically replaced during release)
• If necessary, new unit tests have been added
  • Assertions in unit tests use Truth, see existing tests
  • No JUnit 3 features are used (such as extending class TestCase)
  • If this pull request fixes a bug, a new test was added for a situation which failed previously and is now fixed
• mvn clean verify javadoc:jar passes without errors