Audit GHA workflows with zizmor

[maresb]

Description

This should reduce the chance that we do something dangerous with GHA that might lead to a compromise of the repo.

Mirrors pymc-devs/pymc#7624

Checklist

• Checked that the pre-commit linting/style checks pass
• Included tests that prove the fix is effective or that the new feature works
• Added necessary documentation (docstrings and/or example notebooks)
• If you are a pro: each commit corresponds to a relevant logical change

Type of change

• New feature / enhancement
• Bug fix
• Documentation
• Maintenance
• Other (please specify):

---

📚 Documentation preview 📚: https://pytensor--1136.org.readthedocs.build/en/1136/

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.12%. Comparing base (231a977) to head (e002108).
Report is 187 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1136      +/-   ##
==========================================
+ Coverage   82.10%   82.12%   +0.01%     
==========================================
  Files         185      185              
  Lines       48130    48130              
  Branches     8669     8669              
==========================================
+ Hits        39519    39527       +8     
+ Misses       6444     6438       -6     
+ Partials     2167     2165       -2     

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lucianopaz]

Lgtm