ci: zizmor fixes

[RobPasMue]

Description

Implementing CI best practices.

Issue linked

Closes #2276

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.38%. Comparing base (cd1197f) to head (49c2f4d).
⚠️ Report is 2 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (cd1197f) and HEAD (49c2f4d). Click for more details.

HEAD has 4 uploads less than BASE

Flag	BASE (cd1197f)	HEAD (49c2f4d)
	6	2

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2277      +/-   ##
==========================================
- Coverage   94.52%   85.38%   -9.14%     
==========================================
  Files         169      157      -12     
  Lines       11034    10862     -172     
==========================================
- Hits        10430     9275    -1155     
- Misses        604     1587     +983     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[RobPasMue]

@moe-ad I'd appreciate it if you could have a look at it

[moe-ad]

LGTM. Quite a big change.