chore: add zizmor and cleanup warnings

[gforsyth]

Part of rapidsai/build-planning#275

Adds zizmor checks to CI.

To try to avoid conflicts when updating from upstream, I tried to only touch the CI files that are run by us, so ci.yml and integration-tests.yml (and the actions they make use of).

Other workflow files are ignored in the zizmor.yml

I also pushed up this branch directly to the rapidsai fork to make sure that all of the explicit action pins were in the enterprise allowlist, and they run without issue

[jameslamb]

@trxcllnt @gforsyth could we merge this?

This would resolve the last thing needed to close rapidsai/build-planning#275.

And by the way I've also proposed similar changes upstream at mozilla#2760

[trxcllnt]

Can we just disable zizmor for this repo? I'd rather not deal with all the conflicts when merging in changes from upstream sccache.

[jameslamb]

IMO if we're going to have GitHub Actions running here, we should make these changes.

It's good that this appears not to use any of our self-hosted runners, but otherwise this repo's GitHub Actions workflows have a similar security posture to any of our other public repos.