Add zizmor to pre-commit and fix most findings (#127749)

Add zizmor to pre-commit and fix most findings (#127749) #1553