[Gise23]

Adds a zizmor pre-commit check, and fixes the issues it reports in the existing workflows.

Fixes #191

The Zizmor rules being corrected are:

1. (unpinned-uses) Adding hashes for actions. This prevents an attack by pushing a malicious update (and tag change) to an action repository.
2. (excessive-permissions) Adding permissions blocks everywhere
3. (artipacked) GitHub credentials are cached on checkout, which potentially gives permission for repo-modifying actions. The CI job never pushes, so persist-credentials: false has no side effects.
4. (template-injection) I haven't changed the ${{ }} references, since zizmor only flags them in pedantic mode. The values are hard-coded in the workflow itself, so they can't be influenced by a PR. Let me know if you'd like me to change them too and I'll work on it.

PR Checklist:

• I will abide by the BeeWare Code of Conduct
• I have read and have followed the CONTRIBUTING.md file
• This PR was generated or assisted using an AI tool
  Assisted-by: Claude Code (Claude Opus 5.5)

[kattni]

Thanks for getting this set up! Looks great.

We don't use pedantic mode on any other repo; the real concern is injection of environment variables, rather than the ${{}} syntax itself.