Add zizmor and fix its findings

[dduugg]

Summary

Adds .github/workflows/zizmor.yml, a caller of rubyatscale/shared-config/.github/workflows/zizmor.yml@main (rubyatscale/shared-config#32), and fixes everything zizmor 1.30.1 reports in this repo so the new check starts clean. The same cleanup went into visualize_packs#113 and pks#55.

• zizmor mode: the default advanced-security: true, so results go to the Security tab and findings don't fail the job. The caller grants contents: read and security-events: write.
• Pinned to commit SHAs, with the exact version in a trailing comment:
  • actions/cache v3 → v3.5.0
  • actions/checkout v2 → v7.0.1 (2×)
  • actions/setup-node v1 → v6.5.0
  • actions/setup-node v4 → v4.4.0
  • actions/upload-artifact v3 → v4.6.2
  • checkout moves to v7.0.1, the version shared-config pins. Unless noted below, the rest stay on the release their floating tag runs today.
• persist-credentials: false on 2 checkouts, so the token isn't left in .git/config.
• Documented ignores for the org's deliberate patterns, worded as in the other repos:
  • unpinned-uses on the @main calls into shared-config, which exist so its fixes propagate.
• Dependabot: there was no config, so this adds one for github-actions only (monthly, grouped, 7-day cooldown) to keep the new pins current.
• publish.yml had never run and couldn't have succeeded as written.
  • It used actions/upload-artifact@v3, which GitHub no longer runs. That moves to v4.6.2.
  • setup-node moves from v1 to v6.5.0, with package-manager-cache: false because a tag-triggered publish shouldn't restore a cache (zizmor cache-poisoning).
  • Publishing now uses Node 24, as build.yml does. @vscode/vsce 4 needs Node 22 or later.
  • vsce was installed globally and unpinned on every run (zizmor adhoc-packages). It's now a locked devDependency (@vscode/vsce ^4.0.0) run with npx. That accounts for the package-lock.json diff.
• Not fixed here: npx vsce package still fails locally, because @types/vscode ^1.110.0 is newer than engines.vscode ^1.67.0. The old unscoped vsce runs the same check. Raising the minimum VS Code version is a separate decision.

Test plan

• zizmor 1.30.1 with online audits: 12 findings before, 0 after.
• actionlint reports nothing new.
• Fresh Eyes local review: no findings.
• zizmor / zizmor and the existing checks pass on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.