Add zizmor and fix its findings

[dduugg]

Summary

Adds .github/workflows/zizmor.yml, a caller of rubyatscale/shared-config/.github/workflows/zizmor.yml@main (rubyatscale/shared-config#32), and fixes everything zizmor 1.30.1 reports in this repo so the new check starts clean. The same cleanup went into visualize_packs#113 and pks#55.

• zizmor mode: the default advanced-security: true, so results go to the Security tab and findings don't fail the job. The caller grants contents: read and security-events: write.
• Pinned to commit SHAs, with the exact version in a trailing comment:
  • actions/checkout v6 → v7.0.1 (6×)
  • actions/download-artifact v4 → v4.3.0
  • actions/upload-artifact v4 → v4.6.2
  • oxidize-rb/actions/cross-gem v1 → v1.5.0
  • oxidize-rb/actions/fetch-ci-data v1 → v1.5.0 (2×)
  • oxidize-rb/actions/setup-ruby-and-rust v1 → v1.5.0 (3×)
  • ruby/setup-ruby v1 → v1.327.0 (2×)
  • slackapi/slack-github-action v1.25.0 (2×)
  • checkout moves to v7.0.1, the version shared-config pins. Unless noted below, the rest stay on the release their floating tag runs today.
• persist-credentials: false on 6 checkouts, so the token isn't left in .git/config.
• Documented ignores for the org's deliberate patterns, worded as in the other repos:
  • unpinned-uses on the @main calls into shared-config, which exist so its fixes propagate.
• Dependabot: a 7-day cooldown on every entry, plus a github-actions entry to keep the new pins current.
• CD template injection: the build and release steps expanded matrix.ruby-platform and the gem version straight into shell. They now read them from env vars; the release step already had GEM_VERSION in its env.
• Documented ignores specific to this repo's CD:
  • dangerous-triggers: CD checks out and publishes the default branch, never the triggering run's code or artifacts.
  • adhoc-packages: the smoke test's gem install installs the gem the job just built.
  • use-trusted-publishing: gem push still uses RUBYGEMS_API_KEY. Follow-up: switching to trusted publishing needs a publisher configured for code_ownership on rubygems.org first. After that, this ignore can go.

Test plan

• zizmor 1.30.1 with online audits: 35 findings before, 0 after.
• actionlint reports nothing new.
• Fresh Eyes local review: no findings.
• zizmor / zizmor and the existing checks pass on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.