DEVOPS-977: use v3 of zizmor github workflows

[andrewg-mira]

DEVOPS-977 - Zizmor: Allow trusted tag-pinned github actions

[Copilot]

Pull request overview

Updates the repository’s security scan GitHub Actions workflow to use a newer major version of the reusable Zizmor annotation workflow from MiraGeoscience/CI-tools.

Changes:

• Bump reusable-zizmor-annotate.yml reusable workflow reference from @v2 to @v3 in the security scan workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

PR title indicates switching Zizmor GitHub workflows to v3, but this workflow still calls reusable-zizmor-advanced-security.yml@v2 (line 34). Either update the advanced-security reusable workflow to v3 as well (if available) or adjust the PR title/description to reflect that only the annotate workflow was upgraded.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.28%. Comparing base (8a2adcc) to head (c633ab9).
⚠️ Report is 52 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #859      +/-   ##
===========================================
+ Coverage    91.18%   91.28%   +0.09%     
===========================================
  Files          115      112       -3     
  Lines        10298    10369      +71     
  Branches      1901     1908       +7     
===========================================
+ Hits          9390     9465      +75     
+ Misses         485      477       -8     
- Partials       423      427       +4     

see 17 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.