gh-140681: Freeze pre-commit hooks and update zizmor links

[shenxianpeng]

gh-140681: Update zizmor repo and doc links

[hugovk]

We're in no rush here, it still works because of the redirects.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

And there might be a Sphinx Lint release fairly soon, so could also wait for that.

[hugovk]

As this was still open, I've updated it to also freeze the pre-commit hooks, as discussed at python/devguide#1748 (review). In short, if a repo became compromised, they could rewrite the tag to something malicious. Git SHAs can mitigate this.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

I did these too.