Merge pull request #6721 from andrewpollack/andrewpollack/zizmor-audit

security: Run zizmor on CI, resolve actions

Author: nellshamrell

.github/workflows/checks.yml

@@ -1,13 +1,20 @@
 name: Correctness Checks
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   Run-Markdown-Checks:
+    name: Run Markdown Checks
     runs-on: ubuntu-24.04
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install Python dependencies
-        uses: py-actions/py-dependency-install@v4
+        uses: py-actions/py-dependency-install@9c419aa98bfb42280bdae2b0a736befd9b01e3b1 # v4
         with:
           path: "tools/requirements.txt"
           update-pip: "false"