Add 'zizmor' checks in CI

[jameslamb]

Description

zizmor is a static analyzer for enforcing security best practices in GitHub Actions actions and workflows.

See @gforsyth 's excellent write-up in #390 for details on the types of things it can catch.

We should use it in pre-commit here

Benefits of this work

• improves security for these workflows

Acceptance Criteria

• zizmor is required to pass for CI to pass here

Approach

Add zizmor to .pre-commit-config.yaml and fix whatever it warns about (or suppress false positives with configuration). Follow #390 as an example

Add a small workflow running pre-commit on PRs here.

Update branch rulesets to require that workflow to succeed for PRs to be merged.

Notes

N/A