Add zizmor pre-commit hook

[shenanigansd]

No description provided.

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing br/zizmor (673e2e2) with main (e3848d8)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.29%. Comparing base (b879849) to head (673e2e2).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #139   +/-   ##
=======================================
  Coverage   88.29%   88.29%           
=======================================
  Files           3        3           
  Lines          94       94           
=======================================
  Hits           83       83           
  Misses         11       11           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR adds the zizmor pre-commit hook for security auditing of GitHub Actions workflows and makes related workflow security improvements.

Changes:

• Added zizmor pre-commit hook and meta validation hooks to .pre-commit-config.yaml
• Updated noxfile.py to use "prek" instead of "pre-commit" command
• Improved GitHub Actions security by disabling credential persistence and scoping permissions appropriately

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.pre-commit-config.yaml	Adds meta hooks for validation, zizmor security hook, and removes check-json hook
noxfile.py	Changes pre-commit command to "prek"
.github/workflows/python-publish-pypi.yaml	Adds persist-credentials: false for security
.github/workflows/python-ci.yaml	Scopes id-token permission to specific job that needs it
.github/workflows/dependency-review.yaml	Adds persist-credentials: false for security

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.