chore(ci): apply security fixes, add zizmor workflow

[woodruffw]

90% of this is from --fix=unsafe, with the rest
being being my manual fixups.

In addition to the fixes themselves, I've done the following:

• I added a new top-level workflow that will flag any additional findings in the future (both inline in PRs and also in GitHub's "advanced security" integration). That latter one might need to be disabled though if the org doesn't have it enabled, though.
• I added GitHub Actions to the Dependabot config, and also enabled cooldown everywhere to make it a bit harder for us to introduce newly broken or compromised deps. It's not perfect, but it's better than realtime consumption given that we're already on a monthly deps schedule 🙂

Signed-off-by: William Woodruff william@astral.sh

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.