Use zizmor and various CI updates

[jarrodmillman]

No description provided.

[stefanv]

LGTM. Why do we need the ignore dangerous triggers?

[jarrodmillman]

LGTM. Why do we need the ignore dangerous triggers?

Otherwise we get this error

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> ./.github/workflows/milestone-merged-prs.yaml:3:1
  |
3 | / on:
4 | |   pull_request_target:
5 | |     types:
6 | |       - closed
7 | |     branches:
8 | |       - "main"
  | |______________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

See scikit-image/scikit-image@25cc275

[jarrodmillman]

Still getting

info[template-injection]: code injection via template expansion
  --> .github/workflows/test.yml:43:34
   |
42 |         run: |
   |         --- this run block
43 |           pipx run --python '${{ steps.setup-python.outputs.python-path }}' nox --forcecolor -s test
   |                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low

[stefanv]

Why are we using pull_request_target? I think that's only for when we need to share secrets.