🧪 Integrate Zizmor checks into GHA CI/CD

[webknjaz]

Warning

This is blocked on @jezdez handling jazzband/help#422.

This linter guards against common insecure setups in GitHub Actions and Workflows. It is authored and maintained by a member of the PyPA, contributor to PyPI, former employee of the Trail Of Bits.

Ref: https://zizmor.sh

Contributor checklist

• Included tests for the changes.
• A change note is created in changelog.d/ (see changelog.d/README.md
  for instructions) or the PR text says "no changelog needed".

Maintainer checklist

• If no changelog is needed, apply the bot:chronographer:skip label.
• Assign the PR to an existing or new milestone for the target version
  (following Semantic Versioning).

[webknjaz]

This is now waiting for @jezdez to handle jazzband/help#422.

[sirosen]

Can/should we add a tox environment for this too?

[webknjaz]

I'd say pre-commit, not tox directly. But wanted to start here. You could send in another PR with that while this one is blocked.