Add pinact and zizmor workflow checks

[demeyerthom]

Summary

• Add pinact workflow to verify all GitHub Actions are pinned to commit SHAs
• Add zizmor workflow to audit workflows for security issues
• Pin existing actions in python-release.yml and python-tox.yml to commit SHAs

Note: pypa/gh-action-pypi-publish@release/v1 in python-release.yml uses a branch ref that cannot be pinned automatically.