CI: remove unused worklow; use GITHUB_TOKEN where possible (#104657)

* remove unused worklow; use GITHUB_TOKEN where possible

* pin usages of checkout and setup-go

* Fix zizmor errors

* add zizmor.yml

* fix `changelog.yml`

* fix `core-plugins-build-and-release.yml`

* fix `release-comms.yml`

* update release-pr.yml and run-e2e-suite.yml

* Fix errors in files outside of .github/workflows

* Remove path filter on zizmor.yml

---------

Co-authored-by: Sven Grossmann <svennergr@gmail.com>
Co-authored-by: joshhunt <josh.hunt@grafana.com>

.github/workflows/backend-unit-tests.yml

@@ -17,9 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 jobs:
   grafana:
@@ -29,11 +27,16 @@ jobs:
     name: Grafana
     runs-on: ubuntu-latest-8-cores
     continue-on-error: true
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
         with:
           go-version-file: go.mod
       - name: Generate Go code
@@ -46,11 +49,16 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
     name: Grafana Enterprise
     runs-on: ubuntu-latest-8-cores
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
         with:
           go-version-file: go.mod
       - name: Setup Enterprise