This PR adds the
[zizmor](https://github.com/zizmorcore/zizmor-pre-commit) pre-commit
hook to catch GitHub Actions security vulnerabilities and fixes all
existing findings.

## Changes

1. **Added zizmor pre-commit hook** (v1.23.1) to
`.pre-commit-config.yaml`
2. **Fixed all security issues** found by zizmor auto-fix and manual
fixes:
- `template-injection`: Moved GitHub context expressions to environment
variables
- `secrets-outside-env`: Added `environment:` declarations to jobs using
secrets
- `dangerous-triggers`: Replaced `pull_request_target` with
`pull_request`
- `bot-conditions`: Changed `github.actor` checks to
`github.event.pull_request.user.login`
- `excessive-permissions`: Moved workflow-level permissions to job-level
- `superfluous-actions`: Replaced third-party actions with native tools

## Verification

All workflows now pass zizmor security audit with zero errors/warnings.

## Documentation

- [zizmor documentation](https://docs.zizmor.sh/)
- [zizmor pre-commit
hook](https://github.com/zizmorcore/zizmor-pre-commit)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Bernát Gábor <bgabor8@bloomberg.net>