Add zizmor and lock GitHub Actions dependencies - #493

This PR adds zizmor to the existing lint checks and verifies an Actions lockfile in CI.

This also:

• Sets read-only default workflow permissions and disables credential persistence for CI checkouts.
• Adds 10-minute timeouts to the lint and lockfile jobs.
• Enables grouped Actions updates and quarterly Dependabot updates with a 14-day cooldown, matching CPython.