Track upstream fixes for synced workflow zizmor suppressions

[jezdez]

Follow-up from #361.

zizmor.yml currently ignores auditor-persona findings for workflows synced from conda/infrastructure because those workflow files should not be changed directly in this repository.

conda/infrastructure#1328 already added baseline zizmor coverage upstream, but it does not enable the auditor persona. Running zizmor 1.25.2 --persona=auditor .github/workflows against current conda/infrastructure origin/main still reports findings for the synced workflows, so the remaining upstream task is specifically the auditor-persona cleanup/suppression work.

Synced workflows currently covered by local suppressions here:

• .github/workflows/cla.yml
• .github/workflows/issues.yml
• .github/workflows/labels.yml
• .github/workflows/lock.yml
• .github/workflows/project.yml
• .github/workflows/stale.yml
• .github/workflows/update.yml

The ignored findings include permissions, undocumented permissions, concurrency/job naming, secrets-outside-env, superfluous-actions, artipacked, and template-injection findings depending on the workflow.

Tasks:

• Update conda/infrastructure to run zizmor with the auditor persona, matching this repository's pre-commit configuration.
• Apply the appropriate fixes upstream in conda/infrastructure, or add upstream-owned zizmor ignore entries where a finding is intentionally accepted.
• Sync the updated workflows back into this repository.
• Remove the corresponding ignore entries from zizmor.yml in this repository once the synced workflows no longer need local suppressions.

[jezdez]

Opened the upstream auditor-persona follow-up in conda/infrastructure#1344. That PR enables zizmor --persona=auditor --fix=safe upstream, fixes the mechanical workflow findings, and keeps only the accepted-risk findings in upstream-owned suppressions.