[stable-2.20] ci: fix issues identified by zizmor GHA linter

[oraNod]

Manual backport of #3188

I would say it's sensible to backport these changes from the original PR. I don't think we need to integrate the zizmor session into the noxfile or add any of the comments related to zizmor. Totally open to suggestions there.

Also noticed actions/checkout@v5 on stable branches needs to be bumped to v6. Debating whether to do that in a separate PR or include it here.

[felixfontein]

Also noticed actions/checkout@v5 on stable branches needs to be bumped to v6. Debating whether to do that in a separate PR or include it here.

Both is fine for me.

[oraNod]

Also noticed actions/checkout@v5 on stable branches needs to be bumped to v6. Debating whether to do that in a separate PR or include it here.

Both is fine for me.

I'll do it separately. I know it's an extra review but probably cleaner to separate the things.

[oraNod]

Thanks for the review and approval @felixfontein

[patchback]

Backport to stable-2.17: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 8131b7a on top of patchback/backports/stable-2.17/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

Backporting merged PR #3331 into stable-2.20

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   $ git remote add upstream https://github.com/ansible/ansible-documentation.git

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   $ git fetch upstream
   $ git checkout -b patchback/backports/stable-2.17/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331 upstream/stable-2.17

4. Now, cherry-pick PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 contents into that branch:

   $ git cherry-pick -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

   If it'll yell at you with something like fatal: Commit 8131b7ad32f9ec862473e7d8fd06358fc429815e is a merge but no -m option was given., add -m 1 as follows instead:

   $ git cherry-pick -m1 -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

5. At this point, you'll probably encounter some merge conflicts. You must
   resolve them in to preserve the patch from PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 as close to the
   original as possible.
6. Push this branch to your fork on GitHub:

   $ git push origin patchback/backports/stable-2.17/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

7. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to stable-2.18: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 8131b7a on top of patchback/backports/stable-2.18/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

Backporting merged PR #3331 into stable-2.20

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   $ git remote add upstream https://github.com/ansible/ansible-documentation.git

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   $ git fetch upstream
   $ git checkout -b patchback/backports/stable-2.18/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331 upstream/stable-2.18

4. Now, cherry-pick PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 contents into that branch:

   $ git cherry-pick -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

   If it'll yell at you with something like fatal: Commit 8131b7ad32f9ec862473e7d8fd06358fc429815e is a merge but no -m option was given., add -m 1 as follows instead:

   $ git cherry-pick -m1 -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

5. At this point, you'll probably encounter some merge conflicts. You must
   resolve them in to preserve the patch from PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 as close to the
   original as possible.
6. Push this branch to your fork on GitHub:

   $ git push origin patchback/backports/stable-2.18/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

7. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to stable-2.19: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 8131b7a on top of patchback/backports/stable-2.19/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

Backporting merged PR #3331 into stable-2.20

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   $ git remote add upstream https://github.com/ansible/ansible-documentation.git

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   $ git fetch upstream
   $ git checkout -b patchback/backports/stable-2.19/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331 upstream/stable-2.19

4. Now, cherry-pick PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 contents into that branch:

   $ git cherry-pick -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

   If it'll yell at you with something like fatal: Commit 8131b7ad32f9ec862473e7d8fd06358fc429815e is a merge but no -m option was given., add -m 1 as follows instead:

   $ git cherry-pick -m1 -x 8131b7ad32f9ec862473e7d8fd06358fc429815e

5. At this point, you'll probably encounter some merge conflicts. You must
   resolve them in to preserve the patch from PR [stable-2.20] ci: fix issues identified by zizmor GHA linter #3331 as close to the
   original as possible.
6. Push this branch to your fork on GitHub:

   $ git push origin patchback/backports/stable-2.19/8131b7ad32f9ec862473e7d8fd06358fc429815e/pr-3331

7. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.