GHA Security linting with Zizmor

[VeckoTheGecko]

Proposed new feature or change:

Many open source projects (e.g, xarray pydata/xarray#11269 ) are adopting Zizmor https://docs.zizmor.sh/ to improve the security of GHA workflows. With the increase in AI agent security attacks I think it would be worth considering for this project as well.

[erogluorhan]

Great suggestion, thanks @VeckoTheGecko ! I 100% agree with this, and we will look into it ASAP.

[VeckoTheGecko]

I found a good way to go about it was to do:

zizmor .github --gh-token=$(gh auth token) --fix=unsafe 

which will generate all the pins from the version numbers, commit, then you can iterate with zizmor .github either manually or using an LLM if you want