Bump zizmor to v1.19.0 (#2882)

* Bump zizmor to v1.19.0

Update to zizmor 1.19.0.

* Fix zizmor findings

- Configure a 3-day cooldown for dependabot.
- Suppress false positive.
- Disable overly-paranoid concurrency rule.

Author: martincostello

.github/dependabot.yml

@@ -2,13 +2,17 @@ version: 2
 updates:
 - package-ecosystem: "github-actions"
   directory: "/"
+  cooldown:
+    default-days: 3
   schedule:
     interval: weekly
     day: thursday
     time: "12:00"
     timezone: "America/New_York"
 - package-ecosystem: nuget
   directory: "/"
+  cooldown:
+    default-days: 3
   groups:
     polly:
       patterns:

.github/workflows/lint.yml

@@ -27,7 +27,7 @@ jobs:
       POWERSHELL_YAML_VERSION: '0.4.12'
       PSSCRIPTANALYZER_VERSION: '1.24.0'
       TERM: xterm
-      ZIZMOR_VERSION: '1.13.0'
+      ZIZMOR_VERSION: '1.19.0'
 
     permissions:
       actions: read

.github/workflows/ossf-scorecard.yml

@@ -7,7 +7,7 @@ on:
     - cron: '0 8 * * MON'
   workflow_dispatch:
 
-permissions: read-all
+permissions: read-all # zizmor: ignore[excessive-permissions] Recommended permissions for OSSF Scorecard
 
 jobs:
   analysis:

.github/zizmor.yml

@@ -1,5 +1,10 @@
 rules:
   anonymous-definition:
     disable: true
+  concurrency-limits:
+    disable: true
+  dependabot-cooldown:
+    config:
+      days: 3
   undocumented-permissions:
     disable: true