Add zizmor pre-commit hook and fix security issues (#25)

This PR adds the
[zizmor](https://github.com/zizmorcore/zizmor-pre-commit) pre-commit
hook to catch GitHub Actions security vulnerabilities and fixes all
existing findings.

## Changes

1. **Added zizmor pre-commit hook** (v1.23.1) to
`.pre-commit-config.yaml`
2. **Fixed all security issues** found by zizmor auto-fix and manual
fixes:
- `template-injection`: Moved GitHub context expressions to environment
variables
- `secrets-outside-env`: Added `environment:` declarations to jobs using
secrets
- `dangerous-triggers`: Replaced `pull_request_target` with
`pull_request`
- `bot-conditions`: Changed `github.actor` checks to
`github.event.pull_request.user.login`
- `excessive-permissions`: Moved workflow-level permissions to job-level
- `superfluous-actions`: Replaced third-party actions with native tools

## Verification

All workflows now pass zizmor security audit with zero errors/warnings.

## Documentation

- [zizmor documentation](https://docs.zizmor.sh/)
- [zizmor pre-commit
hook](https://github.com/zizmorcore/zizmor-pre-commit)

Author: gaborbernat

.github/workflows/main.yml

@@ -10,22 +10,28 @@ jobs:
   main-uvx:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: self test action (uvx path)
       uses: ./
   main-uv-run:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - run: printf '[project]\nname = "test"\nversion = "0.0.0"\nrequires-python = ">=3.13"\n' > pyproject.toml
       shell: bash
     - name: self test action (uv run path)
       uses: ./
   main-external-uv:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
-    - uses: astral-sh/setup-uv@v7
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
     - name: self test action (external uv)
       uses: ./
       with:

.pre-commit-config.yaml

@@ -6,5 +6,9 @@ repos:
     -   id: end-of-file-fixer
     -   id: check-yaml
 
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.23.1
+    hooks:
+      - id: zizmor
 ci:
   autoupdate_schedule: quarterly