ci: make ci safe using zizmor

[yihong0618]

Summary

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

As more and more attackers using GitHub Actions to steal the token or attack other users such as Mining Scripts

this patch fix more of them

zizmor: https://woodruffw.github.io/zizmor/

more can check issue one-api or https://www.praetorian.com/blog/compromising-bytedances-rspack-github-actions-vulnerabilities/
we can use static check to avoid them as we can.

e.g.:

astral-sh/ruff#14844

same request for opendal apache/opendal#5502

Tip

Close issue syntax: Fixes #<issue number> or Resolves #<issue number>, see documentation for more details.

Screenshots

Before	After
...	...

Checklist

Important

Please review the checklist below before submitting your pull request.

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods

[laipz8200]

GitHub provides a public preview version of GitHub Actions scanning based on CodeQL, and we are using it. I will also evaluate Zizmor—thank you for your suggestion.

[yihong0618]

GitHub provides a public preview version of GitHub Actions scanning based on CodeQL, and we are using it. I will also evaluate Zizmor—thank you for your suggestion.

yes as doc, zizmor is better for check not for ci.

[laipz8200]

LGTM