chore: Fix GitHub Actions findings with zizmor

[quant-ranger]

This PR automatically fixes findings in GitHub Actions workflows using zizmor.

The following rules are enabled:

• ref-version-mismatch: A ref-version-mismatch occurs when an action is hash-pinned but the associated tag comment (e.g. # v3.8.1) does not match the pinned commit. This can cause tools like Dependabot to silently ignore the comment instead of refreshing it.
• dependabot-cooldown: Ensures that dependabot configurations include a cooldown period.

If you run into any problems, feel free to ping Yannik Tausch (@ytausch) or Manuel Lerchner (@ManuelLerchnerQC).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (217bd24) to head (83ddf32).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #310   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           56        56           
  Lines         3218      3218           
=========================================
  Hits          3218      3218           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.