Add zizmor pre-commit configuration

Inspect the existing GitHub Actions configuration under .github, then review the referenced beeware/.github#378 change and the example .github/zizmor.yml. Add zizmor to the pre-commit pipeline, run it against the actions configuration, and resolve all reported issues while keeping beeware/.github references on @main and documenting any necessary exclusions with the core team.

What is the problem or limitation you are having?

zizmor is a useful tool for performing a static analysis of GitHub actions configurations, auditing for common security issues and related problems. It can be run standalone, but it can also be integrated into pre-commit.

Describe the solution you'd like

We should add zizmor to this project's pre-commit pipeline.

This will require fixing any issues that zizmor identifies with the existing Github actions configuration. Zizmor is able to automatically fix many problem, and it is able to make suggestions about other fixes. However, there are some problems where investigation and a manual fix will be required.

Zimor was recently added to the .github repository (see beeware/.github#378). That pull request may be instructive for how to add a zizmor configuration, the types of problems that Zizmor reports, and the fixes for those problems. The most invasive fixes are:

• unpinned-uses - this requires providing a full hash for a reference to a GitHub Action, rather than just a version number. These hashes must be manually determined. This must be done for all action reference, except for references to beeware/.github actions; see details below.
• template-injection - Use of ${{ }} syntax is a possible vector for security issues because the content isn't escaped; instead of using direct variable substitution, it is necessary to proxy GitHub variables through environment variables.

However, zizmor may find other problems; they should all be resolved.

References to beeware/.github

References to beeware/.github actions are the only actions that are allowed to remain unpinned. As these actions are in the BeeWare repository, the security exposure is different - someone who already has enough access to tamper with those actions likely has access to tamper with other repositories directly.

Any reference to a beeware/.github action should be retained as a reference to @main. A zizmor configuration like this one can be used to silence the zizmor error about unpinned uses.

Describe alternatives you've considered

No real alternative.

Additional context

Skipping rules, excluding files, or raising the minimum report level should not be considered unless absolutely necessary. A member of the core team can advise if you believe you have found a situation that requires an exclusion of this kind; post a comment on this ticket, or ask on Discord if you believe a rule cannot be satisfied.