chore: use new maintainer_tools actions for zizmor, codeql, pre-commit

[blink1073]

References

Description

Switch to the new composite actions from calysto/maintainer_tools v1.3.0 for security scanning and pre-commit tooling. Removes the local zizmor config (the new action bundles its own config as fallback).

Changes

• Replace zizmorcore/zizmor-action with calysto/maintainer_tools/actions/zizmor@v1
• Replace inline CodeQL steps with calysto/maintainer_tools/actions/codeql@v1
• Replace inline pre-commit autoupdate steps with calysto/maintainer_tools/actions/pre-commit-autoupdate@v1
• Replace run: just pre-commit step in static job with calysto/maintainer_tools/actions/pre-commit-run@v1
• Delete .github/zizmor.yml (local config no longer needed)

Backwards-incompatible changes

None

Testing

N/A

AI usage

• Some or all of the content of this PR was generated by AI.
• The human author has carefully reviewed this PR and run this code.
• AI tools and models used: Claude Sonnet 4.6 (Claude Code)