ci: fix zizmor security analysis findings across workflows

Suppresses safe dangerous-triggers findings, resolves template injection via environment variables in reusable-release.yml, and adds explicit permissions to rules_sass-compiler-updates.yml.

Author: alan-agius4

.github/workflows/codeql.yml

@@ -2,6 +2,7 @@ name: 'CodeQL'
 
 on:
   push:
+  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
   schedule:
     # Run every Sunday at 12:00

.github/workflows/dev-infra.yml

@@ -1,6 +1,7 @@
 name: DevInfra
 
 on:
+  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
     types: [opened, synchronize, reopened]
   issues:

.github/workflows/reusable-release.yml

@@ -33,10 +33,12 @@ jobs:
       # Step 1: Extract the ref of the running reusable workflow to use for checking out dev-infra actions.
       - name: Extract dev-infra ref
         id: get-ref
+        env:
+          WORKFLOW_REF: ${{ github.workflow_ref }}
         run: |
           # github.workflow_ref is of the form: "owner/repo/path/to/workflow.yml@ref"
           # Extract the ref (part after @)
-          REF=$(echo "${{ github.workflow_ref }}" | cut -d'@' -f2)
+          REF=$(echo "$WORKFLOW_REF" | cut -d'@' -f2)
           echo "ref=$REF" >> $GITHUB_OUTPUT
 
       # Checkout the calling repository first to ensure there is a .git directory at the root,

.github/workflows/rules_sass-compiler-updates.yml

@@ -6,8 +6,12 @@ on:
     - cron: '0 */6 * * *'
   workflow_dispatch: # Allows you to trigger it manually.
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -38,6 +42,9 @@ jobs:
 
   create_pr:
     needs: build
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     defaults:
       run: