STM32F4 Nucleo - how to set pins low while uploading firmware?
Conceptually you want to halt the board, put all of the pins in a safe state by writing to the GPIO registers over JTAG/SWD, and then rewrite the flash. The default you're seeing is probably either halting the board in an arbitrary state and then reflashing it or resetting and halting it before reflashing it, neither of which gives you any control over the pins.

With something like OpenOCD, you could script it with tcl to write to the GPIO registers after reset but before reflashing. I'm not sure what customization you can do with an ST-Link through ST/System Workbench's tooling, but OpenOCD can also be used with the ST-Link hardware.

You could also write your own bootloader to control the process - that would also let you ensure that the pins stay in a safe state until the the new firmware is loaded.