🔒️ Add zizmor and fix audit findings (#2260)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.pre-commit-config.yaml

@@ -67,3 +67,11 @@ repos:
         entry: uv run python scripts/add_latest_release_date.py
         files: ^release-notes\.md$
         pass_filenames: false
+
+      - id: zizmor
+        name: zizmor
+        language: python
+        entry: uv run zizmor .
+        files: ^\.github\/workflows\/
+        require_serial: true
+        pass_filenames: false