ci: Add GitHub Actions scanner

[decofe]

Summary

• add the pinned tempoxyz/gh-actions GitHub Actions scanner workflow
• fix existing zizmor/actionlint findings without adding ignore baselines
• pin mutable reusable workflow/action refs and move unsafe template expressions through env where needed

Prompted by: @0xalpharush

Validation

• uvx zizmor --offline .github/workflows: passes locally
• actionlint: passes locally