CI update's

[chirizxc]

• Add a GitHub Actions check to CI using zizmor

  • In this case, we need # zizmor: ignore[unpinned-uses] for dtolnay/rust-toolchain@{nightly, stable, master, etc...)

  • Pin all actions by commit (we can use: pinact, actions-up)

  • Add comments (similar to // SAFETY in Rust) to potentially dangerous locations:
    

    pyo3/.github/workflows/cache-cleanup.yml

    Lines 2 to 5 in 126aa44

    	on:
    	pull_request_target:
    	types:
    	- closed

• Use uv instead of pip:
  

  pyo3/.github/workflows/build.yml

  Lines 60 to 61 in 126aa44

  	- name: Install nox
  	run: python -m pip install --upgrade pip && pip install nox[uv]