ci: Resolve Zizmor static security audit findings in GitHub Actions workflows

[vkarampudi]

Description

This PR resolves all static security audit findings reported by Zizmor for GitHub Actions workflows in Struct2Tensor:

1. Explicit Least-Privilege Permissions:

   • Added permissions: contents: read to all jobs and workflow definitions in build.yml and pre-commit.yml to prevent unintended GITHUB_TOKEN privilege escalation.

2. Action SHA Pinning:

   • Pinned all GitHub Actions (actions/checkout, conda-incubator/setup-miniconda, actions/upload-artifact, actions/download-artifact, actions/setup-python, pre-commit/action, pypa/gh-action-pypi-publish) to immutable commit SHAs with version comments.

3. Prevent Credential Persistence:

   • Added persist-credentials: false to all actions/checkout steps to avoid exposing GitHub workspace tokens across build steps.

4. Security Suppressions:

   • Added # zizmor: ignore[use-trusted-publishing] on PyPI publish step to document intentional use of PYPI_API_TOKEN until OIDC publishing is configured.

Verification

Validated locally with Zizmor 1.29:

• 0 High, 0 Medium, 0 Low findings remaining.

[rwitcher]

LGTM