Merge pull request #385 from oscarbenjamin/pr_actions

actions: add zizmor check in CI

actions: minor tweaks for zizmor

actions: remove all template injection

actions: set cancel-in-progress to true

actions: add zizmor ignore for nightly wheels token

actions: set persist-credentials to false

actions: restrict permissions in jobs

actions: use env to avoid shell injection

actions: pin all actions by SHA

Merge pull request #384 from flintlib/dependabot/github_actions/minor-patch-dependencies-7fac7c8293

build(deps): bump the minor-patch-dependencies group with 2 updates

Merge pull request #382 from oscarbenjamin/pr_pyodide_cleanup

Remove dep_py from the meson.build files

Bump pyodide version 0.28.2 -> 0.29.3