Description

Use zizmor to enforce safe practices with github actions.
Only severity high for now, since some of the lower priorities would involve bigger refactors

• Use pinned sha for setup-pixi
• Use safer pull_request instead of pull_request_target which has access to all secrets even across forks
• Access input with env vars. That was fine before as well, since only we trigger that, but it doesn't hurt either.

How Has This Been Tested?

pixi run zizmor

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: Claude

Checklist:

• I have performed a self-review of my own code