chore(ci): address CI lint findings

[woodruffw]

This addresses all of zizmor's non-pedantic findings, and adds a workflow to proactively flag any more that come in.

Key changes:

• I've hash-pinned all actions references. Dependabot will continue to keep these updated and will update the hash comments as well.
• I've marked every actions/checkout with persist-credentials: false except for one that actually needs persisted credentials (which I've explicitly enabled with an explanatory comment)
• I've dropped some workflow-level permissions in favor of job-level permissions that were already provisioned.
• I fixed two small template injections caused by expanding output contexts. I think these were not exploitable in practice, but fixing them is good for defense in depth (and makes spellcheck work nicely on these steps).

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[eifinger]

Thank you for adding these changes to this action as well.

A small request on the added workflow.

[woodruffw]

Thanks for the review @eifinger! I've removed the custom workflow for zizmor and moved the action into the lint job 🙂

[eifinger]

Thank you 🚀