Add zizmor and fix its findings

[dduugg]

Summary

Adds .github/workflows/zizmor.yml, a caller of rubyatscale/shared-config/.github/workflows/zizmor.yml@main (rubyatscale/shared-config#32), and fixes everything zizmor 1.30.1 reports in this repo so the new check starts clean. The same cleanup went into visualize_packs#113 and pks#55.

• zizmor mode: the default advanced-security: true, so results go to the Security tab and findings don't fail the job. The caller grants contents: read and security-events: write.
• Documented ignores for the org's deliberate patterns, worded as in the other repos:
  • unpinned-uses on the @main calls into shared-config, which exist so its fixes propagate.
  • secrets-inherit on secrets: inherit to shared-config. Its workflows declare no workflow_call secrets, so inherit is the only way to pass them.
  • dangerous-triggers on the workflow_run CD trigger, the org's deploy-after-CI-passes pattern.
• Dependabot: a 7-day cooldown on every entry.

Test plan

• zizmor 1.30.1 with online audits: 6 findings before, 0 after.
• actionlint reports nothing new.
• Fresh Eyes local review: its only findings were about the commit message, which was reworded to match this repo.
• zizmor / zizmor and the existing checks pass on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.