use zizmor to lint github action workflows

[keewis]

In times of AI-driven attacks on github actions (where the AI agent drastically reduces the effort needed to attack multiple repositories), it is a good idea to try as much as possible to avoid any of the foot guns that github actions provide.

zizmor is a github actions linter (with autocorrection functionality) that flags many potentially exploitable parts as possible.

For xarray, most of the changes were pinning the actions and limiting the permissions for the default GITHUB_TOKEN.

Note that while I've tried to figure out the needed permissions for each job, I'm not certain I found everything, so merging this may result in breaking CI on main.

I've also created new github environments for the codecov token and the nightly wheels token, which are now duplicated between the environment secrets and the repository secrets. After merging (and making sure the tokens are available as usual) it might be good to remove the repository secrets.

Edit: I've removed the codecov env and instead will ignore the zizmor warning, codecov is not a very sensible secret, and the "deployment" messages in PRs (see below) quickly become annoying.

[keewis]

looks like the deployment messages for codecov may become annoying. This token is not a very sensible secret, so it may also be possible to remove the environment and instead ignore zizmor's warning (codecov is one of the kind of token the warning description explicitly shows how to ignore).

Edit: I've done just that