better security in github actions

[glehmann]

Use https://zizmor.sh to check our github actions (in a github workflow).
Fix the problems shown by zizmor.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull Request Overview

This PR enhances security for GitHub Actions workflows by enforcing least-privilege defaults, disabling credential persistence, and pinning setup-uv to a specific commit.

• Add top-level permissions: {} to lock down default GITHUB_TOKEN permissions
• Disable credential persistence on checkout steps and pin astral-sh/setup-uv to a commit SHA
• Introduce a new zizmor security analysis workflow with SARIF reporting

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/zizmor.yml	New workflow to run zizmor and upload SARIF security findings
.github/workflows/requirements-check.yml	Tighten permissions, update UV setup, combine UV install & sync
.github/workflows/format.yml	Tighten permissions, update UV setup, combine UV install & sync
.github/workflows/code-checkers.yml	Tighten permissions, update UV setup, combine UV install & sync

Comments suppressed due to low confidence (4)

.github/workflows/requirements-check.yml:5

• Setting top-level permissions to an empty map removes the ability to read repository contents, which will break the actions/checkout step. Please explicitly grant contents: read either at the top level or within the job.

permissions: {}

.github/workflows/format.yml:5

• With permissions: {} set, the checkout action cannot read the repository. Add contents: read to restore read access for actions/checkout.

permissions: {}

.github/workflows/code-checkers.yml:5

• Removing all default permissions prevents reading code on checkout. Include contents: read so actions/checkout functions correctly.

permissions: {}

.github/workflows/requirements-check.yml:14

• [nitpick] Consider adding an explicit name: to this step (e.g., name: Setup UV) for clearer workflow logs and better step identification.

    - uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba  # v6.3.1

[psafont]

checkout is now at version 4, they should be updated