ci: analyze workflows with zizmor

[lidavidm]

• Add cooldowns to dependabot.yml
• Pin actions
• Use environment variables instead of directly expanding variables into shell blocks
• Disable caching in packaging.yml since this builds binaries
• Add some missing permissions and concurrency blocks

[lidavidm]

There's some followup work, but I believe both of our cmd.exe blocks are safe (they use cmd.exe for vcvarsall.bat but presumably that can be done in PowerShell too): #4269

[lidavidm]

I'm following iceberg-cpp, which also uses CodeQL. I haven't setup CodeQL here.
https://github.com/apache/iceberg-cpp/pull/618/files#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27

[lidavidm]

I think I'll suppress secrets-outside-env for now. Many of those secrets will be removed soon once @amoeba finishes #4140.

[lidavidm]

It appears the .NET error was already there.

[amoeba]

+1

TIL about https://docs.zizmor.sh/audits/#template-injection.