ci: add zizmor and implement related fixes

[bsoyka]

Description

This PR adds zizmor, a static analysis tool for GitHub Actions.

• Added zizmor as a lint dependency
• Added a just zizmor command
• Added a pre-commit hook to run just zizmor when editing workflow files (this also adds zizmor to GitHub Actions since pre-commit is run on all pushes/PRs)

I also resolved all existing zizmor messages, either by implementing a fix or by ignoring the specific flag in a new .github/zizmor.yml file:

• Pinned all external action references to specific hashes (e.g., cf7aa43dc0026951952b6ae45609ef4539223f05 rather than v1 or master)
  • I did this automatically using gha-update—might be a useful tool to add for this repo, but I figure that's outside the scope of this particular PR.
• Disabled caching in the PyPI release workflow, which zizmor flagged as a potential cache poisoning vulnerability
• Disabled checkout credential persistence in several workflows
• Specified permissions for many workflows
• Fixed a template injection warning in the codeblock-checking workflow
• Ignored warnings about some workflows using the pull_request_target trigger instead of pull_request
• Ignored a message about using PyPI Trusted Publishing until you've implemented that

Fixes #2397

Type of change

CI and developer tooling improvements.

Checklist

• My code adheres to the style guidelines of this project (scripts/lint.sh shows no errors)
• I have conducted a self-review of my own code
• I have made the necessary changes to the documentation
• My changes do not generate any new warnings
• I have added tests to validate the effectiveness of my fix or the functionality of my new feature
• Both new and existing unit tests pass successfully on my local environment by running scripts/test-cov.sh
• I have ensured that static analysis tests are passing by running scripts/static-analysis.sh
• I have included code examples to illustrate the modifications

[bsoyka]

A couple things I've noticed after having CI run here:

• The linting workflow is set to continue on errors, meaning pre-commit fails don't actually show up as a failure anywhere in PR checks. (For example, there are 6 failures on this PR, but all checks are shown as successful.) Not sure if this is intentional?
• The version of just used in CI (1.15.0) isn't compatible with the [doc()] syntax used in this project's justfile, which was added in 1.27.0, causing pre-commit to fail every time it runs in GitHub Actions. Should I bump that version number here?
• There's a false positive showing up in the secret detection pre-commit hook, which I've separately fixed in ci: ignore secret detection false positive #2399.

[CLAassistant]

All committers have signed the CLA.