ci: add zizmor to lint-actions (#37720)

Adds [zizmor](https://docs.zizmor.sh/) to `make lint-actions` with
`--min-confidence=medium`. Fixes the remaining findings:

- Pin floating-tag service images in `pull-db-tests.yml` to
`tag@sha256:digest`
- Move `github.ref` / `github.ref_name` (and surrounding secrets/step
outputs for consistency) out of `run:` into `env:`

---
This PR was written with the help of Claude Opus 4.7

---------

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: Giteabot <teabot@gitea.io>

pyproject.toml

@@ -7,6 +7,7 @@ requires-python = ">=3.10"
 dev = [
   "djlint==1.36.4",
   "yamllint==1.38.0",
+  "zizmor==1.25.1",
 ]
 
 [tool.djlint]