ci: Resolve GitHub Actions security and fix Zizmor audit findings

[vkarampudi]

Summary of Changes

This PR addresses all security findings and warnings reported by the centralized Zizmor security scanner (google-gh-automation / Zizmor) across the repository's GitHub Actions workflows and build configurations.

Key Improvements

1. Least-Privilege Permissions (excessive-permissions & artipacked):

   • Added global permissions: contents: read to all workflows (ci-lint.yml, conda-build.yml, docs.yml).
   • Added persist-credentials: false across all actions/checkout steps to avoid persisting GitHub tokens into build runners.
   • Scoped id-token: write strictly to the upload_to_pypi job in conda-build.yml.
   • Converted docs.yml to pure read-only doc syntax validation (mkdocs build), eliminating unnecessary contents: write tokens on PRs.

2. Template Injection Remediation (template-injection):

   • In .github/reusable-build/action.yml, replaced inline ${{ matrix.python-version }} interpolation with a safely scoped environment variable PYTHON_VERSION.

3. Full Action SHA Pinning (unpinned-uses & known-vulnerable-actions):

   • Pinned all GitHub Actions to exact, immutable commit SHAs with version comments:
     • actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 (# v4.2.2)
     • actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 (# v5.4.0)
     • mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d (# v1.11.0)
     • actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 (# v4.6.1)
     • actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 (# v4.1.8)
     • pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd (# v3.0.1)
     • pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 (# release/v1) with # zizmor: ignore[use-trusted-publishing]

4. macOS ARM64 Apple Silicon Toolchain Fix:

   • Added --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 to .bazelrc and setup.py on Darwin to route compilation directly through system Clang, preventing Bazel's wrapped_clang dyld crashes on macOS 14/15 runners.

Verification

• Validated locally with zizmor (v1.25.2 & v1.29.0): 0 findings (Clean pass, exit code 0).

[rwitcher]

LGTM