Add zizmor pre-commit configuration

## What is the problem or limitation you are having?

[zizmor](https://docs.zizmor.sh) is a useful tool for performing a static analysis of GitHub actions configurations, auditing for common security issues and related problems. It can be run standalone, but it can also be integrated into pre-commit.

## Describe the solution you'd like

We should add zizmor to this project's pre-commit pipeline.

This will require fixing any issues that zizmor identifies with the existing Github actions configuration. Zizmor is able to automatically fix many problem, and it is able to make suggestions about other fixes. However, there are some problems where investigation and a manual fix will be required.

Zimor was recently added to the `.github` repository (see beeware/.github#378). That pull request may be instructive for how to add a zizmor configuration, the types of problems that Zizmor reports, and the fixes for those problems. The most invasive fixes are:

* `unpinned-uses` - this requires providing a full hash for a reference to a GitHub Action, rather than just a version number. These hashes must be manually determined. This must be done for *all* action reference, *except* for references to `beeware/.github` actions; see details below.
* `template-injection` - Use of `${{ }}` syntax is a possible vector for security issues because the content isn't escaped; instead of using direct variable substitution, it is necessary to proxy GitHub variables through environment variables.

However, zizmor may find other problems; they should all be resolved.

### References to `beeware/.github`

References to `beeware/.github` actions are the *only* actions that are allowed to remain unpinned. As these actions are in the BeeWare repository, the security exposure is different - someone who already has enough access to tamper with those actions likely has access to tamper with other repositories directly.

Any reference to a `beeware/.github` action should be retained as a reference to `@main`. A zizmor configuration like [this one](https://github.com/beeware/briefcase-macOS-Xcode-template/blob/main/.github/zizmor.yml) can be used to silence the zizmor error about unpinned uses.

## Describe alternatives you've considered

No real alternative.

## Additional context

Skipping rules, excluding files, or raising the minimum report level should not be considered unless absolutely necessary. A member of the core team can advise if you believe you have found a situation that requires an exclusion of this kind; post a comment on this ticket, or ask on Discord if you believe a rule cannot be satisfied.