chore: Fix GitHub Actions findings with zizmor (#196)

This PR automatically fixes findings in GitHub Actions workflows using
[`zizmor`](https://github.com/woodruffw/zizmor).

The following rules are enabled:
- **ref-version-mismatch**: A ref-version-mismatch occurs when an action
is hash-pinned but the associated tag comment (e.g. `# v3.8.1`) does not
match the pinned commit. This can cause tools like Dependabot to
silently ignore the comment instead of refreshing it.
- **dependabot-cooldown**: Ensures that dependabot configurations
include a cooldown period.

If you run into any problems, feel free to ping @ytausch or @pavelzw.

Co-authored-by: quant-ranger[bot] <132915763+quant-ranger[bot]@users.noreply.github.com>

Author: quant-ranger[bot]

.github/dependabot.yml

@@ -10,3 +10,5 @@ updates:
       gh-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7