Update GitHub CI workflow

Prompted by https://github.com/magit/magit/pull/4780.

* .github/workflows/test.yml (permissions): Restrict default token
permissions for entire workflow.
(emacs_version): Add Emacs 28.2.
(actions/checkout): Update to v3.  Restrict lifetime of
authentication token.

.github/workflows/test.yml

@@ -1,6 +1,6 @@
 name: CI
 on: [push, pull_request]
-
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -21,12 +21,15 @@ jobs:
           - '27.1'
           - '27.2'
           - '28.1'
+          - '28.2'
           - 'snapshot'
         include:
           - emacs_version: 'snapshot'
             allow_failure: true
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - uses: purcell/setup-emacs@master
       with:
         version: ${{ matrix.emacs_version }}