Zizmor security fixes for github workflows

[vikramvs-gg]

Description

This PR addresses all security findings identified by zizmor across the repository's GitHub Action workflows to ensure they comply with modern supply-chain security best practices.

Changes included:

• Zizmor Automated Fixes: Applied zizmor's automated remediations to resolve various configuration warnings across multiple workflow files addressing unpinned-uses, template-injection.

• Acknowledge pull_request_target: Added a suppression comment (# zizmor: ignore[dangerous-triggers]) to label-external.yml. The pull_request_target trigger is functionally required here to elevate token permissions (issues: write) for labeling PRs from forks. This is safe as a false positive because the workflow's checkout action pulls the base develop branch rather than executing the untrusted PR code.

Verification

• Ran zizmor --gh-token=$(gh auth token) .github/workflows/ locally.
• Verified that the output reports 0 findings (all remaining findings correctly suppressed or ignored).

zizmor --gh-token=$(gh auth token) .github/workflows/
 INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed .github/workflows/close-inactive-issues.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/dependency-review.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/draft-release-notes.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/inactive-pr.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/label-external.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/multi-approvers.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr-description-check.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr-label-validation.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr-precommit.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/publish-release-notes.yml
No findings to report. Good job! (1 ignored, 38 suppressed)

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.