[3.12] Add zizmor to pre-commit and fix most findings (GH-127749) (#127788)

(cherry picked from commit ae31df354d02e12bf656954c5c72380d96c1dc0e)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com>
Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>