Add zizmor workflow

[gutzbenj]

No description provided.

[Copilot]

PR Overview

This PR introduces a new GitHub workflow for the zizmor tool and updates several existing workflows to standardize configuration options such as permissions and credential persistence.

• Added .github/workflows/zizmor.yml to define a new workflow for zizmor.
• Updated various workflows (coverage, release, tests, lint, unused, docker-publish, codeql, docker-cleanup, dependency-review) to include a "permissions: {}" stanza and ensure “persist-credentials: false” is configured where applicable.
• Updated pyproject.toml to add the zizmor dependency and register a corresponding task.

Reviewed Changes

File	Description
.github/workflows/zizmor.yml	New workflow to run zizmor tasks.
.github/workflows/coverage.yml	Added permissions override and updated checkout credentials action.
.github/workflows/release.yml	Standardized permissions and disabled cache for setup-uv.
.github/workflows/tests.yml	Updated checkout step with persist-credentials setting.
.github/workflows/lint.yml	Added permissions override and adjusted checkout settings.
.github/workflows/unused.yml	Added permissions override and updated checkout settings.
.github/workflows/docker-publish.yml	Added permissions, disabled cache for setup-uv, and updated checkout.
.github/workflows/codeql.yml	Added permissions override and revised checkout settings.
.github/workflows/docker-cleanup.yml	Added permissions override in the scheduled cleanup workflow.
pyproject.toml	Added zizmor dependency and corresponding task for execution.
.github/workflows/dependency-review.yml	Updated checkout step with persist-credentials setting.

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.86%. Comparing base (df044ab) to head (2955e87).
Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1440      +/-   ##
==========================================
+ Coverage   82.83%   82.86%   +0.03%     
==========================================
  Files          88       88              
  Lines        6293     6293              
  Branches      737      737              
==========================================
+ Hits         5213     5215       +2     
+ Misses        871      870       -1     
+ Partials      209      208       -1     

Flag	Coverage Δ
unittests	82.86% <ø> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.