fix zizmor checks

zizmor 1.23.0 added a check for secrets outside envs: https://docs.zizmor.sh/audits/#secrets-outside-env

We need to determine if possible to set environment secrets or add an ignore if this is not possible.
Reference run: https://github.com/canonical/testflinger/actions/runs/22961442709/job/66652916870?pr=962

Start with the referenced zizmor secrets-outside-env audit and the linked GitHub Actions run. Inspect the workflow configuration implicated by that run to determine whether the secrets can use environments; if not, apply the documented ignore approach. Done when the zizmor 1.23.0 check passes and the chosen handling is clear.

Written by the indexing model from the issue text.