ci: add zizmor GitHub Actions security scanner to pre-commit

[jmclong]

Add the zizmor-pre-commit hook (v1.26.1) running the strictest "auditor" persona to catch security issues in GitHub Actions workflows and Dependabot config.

Clear the pre-existing findings so the hook passes clean:

• dependabot.yml: add a 7-day cooldown to every update ecosystem
• push workflows (docker-push-template, helm-push-template): drop the redundant workflow-level id-token: write (excessive-permissions); each job already grants its own
• document all job-level permissions with explanatory comments
• add explicit job names to satisfy anonymous-definition
• test-e2e-pr.yml: move github.run_id / github.run_attempt into env vars so they are no longer expanded directly into a run block (template-injection)

[Copilot]

Pull request overview

This PR strengthens the repository’s CI and supply-chain hygiene by adding the zizmor GitHub Actions security scanner to pre-commit and aligning workflow/dependabot configuration to satisfy stricter security checks.

Changes:

• Add zizmor-pre-commit (v1.26.1) with the strict auditor persona to the pre-commit hook set.
• Reduce/clarify GitHub Actions token permissions: remove redundant workflow-level privileges in reusable push workflows and document job-level permissions; add explicit job name: fields to avoid anonymous job definitions.
• Update configs to avoid zizmor findings (Dependabot cooldowns; avoid direct ${{ ... }} expansion inside a run: block in the E2E PR workflow).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.pre-commit-config.yaml	Adds the zizmor pre-commit hook configured for strict auditing.
.github/workflows/test.yml	Adds an explicit job name to satisfy stricter workflow auditing.
.github/workflows/test-e2e-pr.yml	Moves github.run_id / github.run_attempt into env vars before use in run: to avoid template-injection style findings.
.github/workflows/push-tag.yml	Documents job-level permissions used when invoking reusable push workflows.
.github/workflows/lint.yml	Adds an explicit job name to satisfy stricter workflow auditing.
.github/workflows/helm-push-template.yml	Removes workflow-level permissions and documents minimal job-level permissions.
.github/workflows/helm-build-template.yml	Adds an explicit job name to satisfy stricter workflow auditing.
.github/workflows/docker-push-template.yml	Removes workflow-level permissions and documents minimal job-level permissions for push jobs.
.github/workflows/docker-build-template.yml	Adds an explicit job name to satisfy stricter workflow auditing.
.github/workflows/devskim.yml	Adds explanatory comments for job-level permissions (least privilege documentation).
.github/workflows/dependency-review.yml	Adds an explicit job name to satisfy stricter workflow auditing.
.github/workflows/codeql.yml	Adds explanatory comments for job-level permissions (least privilege documentation).
.github/dependabot.yml	Adds a 7-day cooldown per ecosystem to reduce update noise and satisfy auditing expectations.