feat: Add zizmor pre commit hook

[ManuelLerchnerQC]

• Add zizmor as a pre-commit hook for auditing GitHub Actions workflows
• Add zizmor to lint dependencies in both the root pixi.toml and template/pixi.toml.jinja
• Fix zizmor findings:
  • add persist-credentials: false to all actions/checkout steps
  • add cooldown config to dependabot.yml.

All rendered workflow templates pass zizmor with zero findings