DEVOPS-977: use v3 of zizmor github workflows

[andrewg-mira]

DEVOPS-977 - Zizmor: Allow trusted tag-pinned github actions

[Copilot]

Pull request overview

This PR updates the GitHub Actions workflow definitions to use v3 of the zizmor security scanning workflows from the MiraGeoscience/CI-tools repository. The change ensures the security scanning jobs are using the latest version of the reusable workflows.

Changes:

• Updated reusable-zizmor-advanced-security.yml reference from v2 to v3 (used for security scanning on push and release events)
• Updated reusable-zizmor-annotate.yml reference from v2 to v3 (used for security scanning on pull requests)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.28%. Comparing base (d600267) to head (c35dd23).
⚠️ Report is 8 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #364      +/-   ##
===========================================
+ Coverage    90.76%   91.28%   +0.51%     
===========================================
  Files          112      120       +8     
  Lines         6388     6652     +264     
  Branches       787      806      +19     
===========================================
+ Hits          5798     6072     +274     
+ Misses         405      383      -22     
- Partials       185      197      +12     

see 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.