ci(gh-actions): resolve zizmor findings

[madhavilosetty-intel]

• Set persist-credentials: false on actions/checkout in api-test, codeql-analysis, dependency-review, docker-image, node.js, semantic and trivy-scan; none of these jobs push back to git.
• Move the workflow_dispatch docker_registry / docker_tag_name inputs out of the run block and into step env vars in docker-image, so the untrusted values are no longer interpolated into the shell.
• Add .github/zizmor.yml ignoring dependabot-cooldown, documenting why daily updates with no cooldown are acceptable here.

PR Checklist

• Unit Tests have been added for new changes
• API tests have been updated if applicable
• All commented code has been removed
• If you've added a dependency, you've ensured license is compatible with Apache 2.0 and clearly outlined the added dependency.

What are you changing?

Anything the reviewer should know when reviewing this PR?

If the there are associated PRs in other repositories, please link them here (i.e. device-management-toolkit/repo#365 )

[Copilot]

Pull request overview

This PR addresses Zizmor security findings in the GitHub Actions CI configuration by reducing credential persistence during checkout and avoiding direct shell interpolation of untrusted workflow_dispatch inputs. It also introduces a Zizmor config file to document and suppress an intentional Dependabot cooldown rule finding.

Changes:

• Set persist-credentials: false on actions/checkout across multiple workflows that don’t need to push to the repo.
• Refactor docker-image.yml to pass workflow_dispatch inputs via step env variables before use in run.
• Add .github/zizmor.yml to ignore the dependabot-cooldown rule (with rationale).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/zizmor.yml	Adds Zizmor configuration to document/ignore an intended rule finding.
.github/workflows/api-test.yml	Disables persisted checkout credentials for the API test workflow.
.github/workflows/codeql-analysis.yml	Disables persisted checkout credentials for CodeQL workflow.
.github/workflows/dependency-review.yml	Disables persisted checkout credentials for dependency review workflow.
.github/workflows/docker-image.yml	Disables persisted checkout credentials and avoids direct input interpolation in the shell.
.github/workflows/node.js.yml	Disables persisted checkout credentials for Node.js CI workflow.
.github/workflows/semantic.yml	Disables persisted checkout credentials for semantic/commit linting workflow.
.github/workflows/trivy-scan.yml	Disables persisted checkout credentials for Trivy scan workflow.