Add zizmor to the pre-commit configuration

[krishkumar6]

Adds the zizmor pre-commit hook, and resolves all findings it reports against the GitHub Actions configuration:

• unpinned-uses: all action and reusable-workflow references are pinned to full commit hashes.
• excessive-permissions: workflows now default to contents: read, with jobs declaring any elevated permissions they need explicitly.
• artipacked: checkout no longer persists credentials.
• secrets-inherit: dependabot-changenote now passes BRUTUS_PAT_TOKEN explicitly instead of inheriting all secrets.
• dependabot-cooldown: all Dependabot ecosystems use a 7-day cooldown.
• superfluous-actions: the release is created with "gh release create" instead of ncipollo/release-action.

Fixes #215

PR Checklist:

• I will abide by the BeeWare Code of Conduct
• I have read and have followed the CONTRIBUTING.md file
• This PR was generated or assisted using an AI tool

Assisted-by:

[freakboy3742]

Thanks for the PR; however, you'll need to familiarize yourself with our contribution guide. In particular, you haven't used our PR template.

In addition, your change has broken the CI pipeline, so none of the CI tasks are running.