Resolve zizmor pedantic workflow findings

[bboe]

Clears the remaining advisory zizmor --pedantic findings and bumps the praw-dev/.github reusable-workflow pins to v1.6.0.

Changes

• ci.yml — workflow-level read-all → contents: read (excessive-permissions).
• scorecard.yml — read-all → {} (the analysis job keeps its own scoped grant), inline permission comments (undocumented-permissions), and a concurrency: group (concurrency-limits).
• pypi.yml — inline comment on id-token: write (undocumented-permissions) and a concurrency: group (concurrency-limits).
• dependabot.yml — add a 1-day cooldown (dependabot-cooldown).
• Bump all praw-dev/.github reusable-workflow pins to v1.6.0.

Verified: zizmor --pedantic reports no findings and actionlint passes.