chore: secure CI

[henryiii]

Prompted by pypa/hatch#2292.

🤖 AI text below 🤖

• Pin all GitHub Actions to full commit SHAs, with the version in a comment.
• Update hynek/build-and-inspect-python-package to v3 (no more moving major tags), actions/download-artifact to v8.0.1, and pypa/gh-action-pypi-publish to a pinned v1.14.2.
• Add persist-credentials: false to all checkout steps.
• Add permissions: {} at workflow level in CI and CD, and add comments for the publish job permissions.
• Add a concurrency group to CD.
• Add the zizmor pre-commit hook with the pedantic persona. zizmor --persona=pedantic .github is clean.
• Freeze all pre-commit hooks to SHAs with a 7-day cooldown.
• Change Dependabot to monthly grouped updates with a 7-day cooldown.
• Add exclude-newer = "7 days" to the uv configuration.