ci: address issues reported by zizmor

[holyspectral]

After integrating with zizmor, we're getting many warnings reported. We should look into them and fix them if possible.