Lingering CI/CD pins, add cooldowns, remove template injections

[woodruffw]

Description

This follows #4901 and #4905 with some more small CI/CD security improvements. It hash-pins some of the dependencies added with #4611, minimizes more workflow/job permissions, and eliminates a few template injections (which probably aren't exploitable in practice in this context, but are still good to remove IMO!)

Following this, there's only one finding left from zizmor (which will unfortunately be nontrivial to fix, since it involves a workflow_run trigger). I'm happy to try and take a look at that, but the "fix" might be a removal of functionality so I'll file an issue for consultation first.

Separately, I'm happy to send a PR enabling zizmor in your CI, either through pre-commit or zizmor-action. Let me know if either of these would be helpful; there's plenty of PSF / PyPA / PyPI / etc. reference material I can share for others using it!

Checklist - did you ...

• Implement any code style changes under the --preview style, following the
  stability policy?
• Add an entry in CHANGES.md if necessary?
• Add / update tests if necessary?
• Add new / update outdated documentation?

Like with the other PRs, I think none of the above apply 🙂

[woodruffw]

Note: this and below prevents Dependabot from sending update PRs for dependency updates that are less than 7 days old. You can tweak this number (or I can remove it entirely), but I'd recommend some degree of "cooldown" since it's currently effective against the kinds of package compromises that have become increasingly common: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

[github-actions]

diff-shades reports zero changes comparing this PR (7dbd200) to main (7916e4a).

---

What is this? | Workflow run | diff-shades documentation

[JelleZijlstra]

Thanks so much! I'd accept a PR adding zizmor to CI.

As for the remaining workflow_run issue, looks like it's https://github.com/psf/black/blob/main/.github/workflows/diff_shades_comment.yml . We'd have to talk about how to handle it; maybe it's fine to restrict the capabilities of the workflow in some way.