Harden GHA + Zizmor CI

[rastut]

This pull request introduces several improvements to GitHub workflow files, focusing on enhanced security, better credential management, and improved maintainability. The most significant changes include adding a new security analysis workflow with zizmor, switching to local action references for tooling, enforcing token and credential usage best practices, and updating third-party action versions for reproducibility.

Security and Analysis Enhancements:

• Added a new .github/workflows/zizmor.yaml workflow to run security analysis on workflow and action files using zizmor, with appropriate permissions and credential handling.
• Added explicit permissions blocks to .github/workflows/bd_sca_scanner.yaml and .github/workflows/trufflehog.yaml to restrict access to only what's needed for actions/checkout. [1] [2]

Credential and Token Management Improvements:

• Set persist-credentials: false for all actions/checkout steps in hyperforge_agent_package_workflow.yaml and hyperforge_workflow.yaml to prevent leaking repository tokens to subsequent steps. [1] [2] [3] [4] [5]
• Switched from workflow expression interpolation to environment variables for passing inputs.package in hyperforge_agent_package_workflow.yaml, improving security and reliability.

Tooling and Action Reference Updates:

• Changed references to custom actions (parameter-generator, build-img-regcache, build-helm-chart) from remote to local paths in hyperforge_workflow.yaml, improving maintainability and reducing external dependencies. [1] [2] [3]
• Added steps to generate and use a GitHub App token for checking out the tooling repository, further restricting credentials and following best practices.

Dependency Version Pinning:

• Updated the orgoro/coverage action to a specific commit hash for reproducible builds in hyperforge_workflow.yaml.

Other Minor Improvements:

• Added comments and documentation regarding the use of PyPI tokens and the future migration to OIDC Trusted Publishing in hyperforge_agent_package_workflow.yaml.
• Improved environment variable usage for Slack notifications in hyperforge_workflow.yaml.