ci: harden GitHub Actions workflows

[flavorjones]

Summary

Hardening the GitHub Actions workflows per recommendations from `zizmor` and `pinact`:

• Pin all actions to commit SHAs to prevent supply chain attacks via mutable version tags
• Batch Dependabot action updates into a single grouped PR rather than one per action
• Scope broad permissions to jobs in `publish-image.yml` — `packages: write`, `id-token: write`, and `attestations: write` were at the workflow level; now scoped to the jobs that need them (`attestations: write` only on the `build` job)
• Disable credential persistence after checkout in all workflows that don't need it; `dependabot-sync-saas-lockfile.yml` retains credentials with a comment explaining why (it does a `git push`)
• Fix template injection in `publish-image.yml` by routing `steps.meta.outputs.tags` through `env:` variables before shell interpolation
• Suppress `secrets-outside-env` in `test.yml` with a comment — the secret is a `workflow_call` input and this workflow never runs on PRs, so a GitHub Environment would be inappropriate
• Add a `zizmor` CI job to `ci-checks.yml` so future workflow changes are automatically audited on every PR

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflows against supply-chain and credential exposure risks by pinning third-party actions and reducing token persistence, plus addressing an expression-to-shell interpolation risk in the image publishing workflow.

Changes:

• Pin GitHub Actions uses: references to specific commit SHAs (instead of mutable tags).
• Set persist-credentials: false on actions/checkout steps to reduce token exposure.
• Avoid direct ${{ ... }} interpolation into bash in publish-image.yml by passing step outputs via env:.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/test.yml	Pins checkout/setup-ruby actions and disables persisted checkout credentials.
.github/workflows/publish-image.yml	Pins Docker/GitHub actions, disables persisted checkout credentials, and routes metadata output through env to avoid expression injection into bash.
.github/workflows/dependabot-sync-saas-lockfile.yml	Pins actions and disables persisted checkout credentials (but this workflow also pushes commits).
.github/workflows/ci-checks.yml	Pins checkout/setup-ruby actions and disables persisted checkout credentials across jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.