Conditionally include help source tracking to preserve ABI.
Docs builds can (and should) use `ENABLE_HELP_SOURCE` so that the generated sphinx docs can perform default grouping and link to source files.
Regular user-builds don't need the source tracking.
> A static analysis tool for Github Actions
https://github.com/woodruffw/zizmor
Mostly means adding `persist-credentials: false` to checkouts and replacing `{{ env.VARNAME }}` with shell substitution.
Since `docs/prep` is a prerequisite of `docs`, and should be the *only* prerequisite, calling `make docs` could end up hiding a problem with files missing from the uploaded artifact. Instead, call `make` from the docs directory which should be closer to what will run on RTDs.
