harden GitHub Actions workflows with zizmor

[crazy-max]

similar to moby/buildkit#6623

This adds zizmor coverage for GitHub Actions workflows and tightens the workflows so the reported findings are either fixed directly or documented where the current trust model is intentional.

Dependabot is also configured to keep GitHub Actions updates moving.

Also the release workflow now uses the better maintained softprops/action-gh-release to be consistent with other repos in the org.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[docker-agent]

Assessment: 🟢 APPROVE

The workflows are well-hardened: permissions are appropriately scoped, action references are pinned to SHA digests, pull_request_target triggers use safe patterns, and the switch to softprops/action-gh-release is consistent with org conventions. No bugs or security issues were found in the introduced changes.

[docker-agent]

Assessment: 🟢 APPROVE

This PR cleanly hardens the GitHub Actions workflows: permissions are narrowed at both the workflow and job levels, all action references are pinned to SHA digests, zizmor scanning is integrated, Dependabot is configured for automatic action updates, and the release workflow switches to the better-maintained softprops/action-gh-release. No confirmed or likely bugs were found in the added code.

Dismissed security findings (review manually)

• .github/workflows/zizmor.yml:20 — Third-party reusable workflow (crazy-max/.github) with security-events: write — transitive action pinning within the external workflow is not guaranteed (verifier mitigation: direct dependency is pinned to commit SHA 46267a6e...; crazy-max is a well-known maintainer and the PR author; security-events: write is narrowly scoped for SARIF upload only; the concern is speculative without evidence of a compromised transitive dependency)