ci: pin containers to digest, enable more zizmor rules (#38779)

Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>

.github/workflows/cache-seeder.yml

@@ -69,9 +69,10 @@ jobs:
       - run: make generate-go
         env:
           TAGS: ${{ matrix.tags }}
-      - run: make ${{ matrix.target }}
+      - run: make "$TARGET"
         env:
           TAGS: ${{ matrix.tags }}
+          TARGET: ${{ matrix.target }}
 
   # reclaims the caches this run superseded, so the next save still fits in the allowance
   prune: