fix: add zizmor and remediate all findings

[gforsyth]

Changes

• all upstream actions are pinned to SHAs (with versions in comments, so renovate still works

• all permissions are explicitly set now, and we don't persist credentials

• all inputs are sanitized -- this is done by moving inputs to env-variables and referencing those

• added zizmor to pre-commit so these fixes stay in place

• fix(ci): pin all third-party actions and workflows

• fix: artipacked credential fixes

• fix: remove template injection sites

• fix: explicitly request all needed permissions

• fix: ignore secrets-inherit where we want inherited secrets

• fix: ignore dangerous-triggers for breaking change alert

• fix: mark cache-poisoning warning as a non-issue

• feat: add zizmor pre-commit hook

[gforsyth]

/merge