ci: Resolve GitHub Actions security and fix Zizmor findings for TFX

[vkarampudi]

Summary of Changes

This PR addresses all security findings and warnings reported by the centralized Zizmor security scanner (google-gh-automation / Zizmor) across the repository's GitHub Actions workflows and documentation build configuration.

Key Improvements

1. Least-Privilege Permissions (excessive-permissions & artipacked):

   • Added global permissions: contents: read to all workflows (ci-lint.yml, ci-test.yml, cd-docs.yml, wheels.yml, stale.yml, csat.yml).
   • Added persist-credentials: false across all actions/checkout steps to avoid persisting GitHub tokens into build runners.
   • Scoped id-token: write strictly to the upload_to_pypi job in wheels.yml.
   • Scoped issue/PR write permissions strictly to the triage jobs in stale.yml and csat.yml.
   • Converted cd-docs.yml to pure read-only doc syntax validation (mkdocs build), eliminating unnecessary contents: write tokens on PRs.

2. Template Injection Remediation (template-injection):

   • In ci-lint.yml, passed event metadata safely via environment variables instead of inline bash interpolation.
   • In wheels.yml, replaced ${{ matrix.ls }} template expansion with direct bash commands.

3. Full Action SHA Pinning (unpinned-uses & known-vulnerable-actions):

   • Pinned all GitHub Actions to exact, immutable commit SHAs with version comments:
     • actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 (# v4.2.2)
     • actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 (# v5.4.0)
     • jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be (# v1.3.1)
     • bazel-contrib/setup-bazel@e403ad507104847c3539436f64a9e9eecc73eeec (# 0.8.5)
     • actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 (# v4.6.1)
     • actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 (# v4.1.8)
     • actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 (# v9.1.0)
     • actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea (# v7.0.1)
     • pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd (# v3.0.1)
     • pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 (# release/v1) with # zizmor: ignore[use-trusted-publishing]

4. Documentation Build Compatibility (mkdocs.yml):

   • Moved inventories: directly under mkdocstrings: to maintain compatibility with modern mkdocstrings-python releases.

Verification

• Validated locally with zizmor (v1.25.2 & v1.29.0): 0 findings (Clean pass, exit code 0).

[rwitcher]

LGTM