SEC: several vulnerabilities detected by zizmor

I would like to propose enabling continuous security scanning with zizmor given the critical place this repo sits in the ecosystem's suplly chain. At the time of opening, most (possibly all) existing vulnerabilities can be fixed automatically or with minimal effort, and I've started issuing PRs in that direction. Linked PRs - #2766 - #2767 - #2744 - #2769 - #2771