ci: pin containers to digest, enable more zizmor rules (#38779)

Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>

.github/workflows/release-nightly-snapcraft.yml

@@ -31,10 +31,11 @@ jobs:
       - name: Publish snap
         run: |
           for attempt in 1 2 3 4 5; do
-            snapcraft upload "${{ steps.build.outputs.snap }}" --release latest/edge && exit 0
+            snapcraft upload "$SNAP" --release latest/edge && exit 0
             echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
             sleep 15
           done
           exit 1
         env:
+          SNAP: ${{ steps.build.outputs.snap }}
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}