[release-11.6.2] Backport workflow fixes (#104695)

* Copy workflows and actions from main

* add zizmor.yml

.github/workflows/alerting-update-module.yml

@@ -18,7 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
-
+        with:
+          persist-credentials: false
       - name: Check if update branch exists
         run: |
           if git ls-remote --heads origin update-alerting-module | grep -q 'update-alerting-module'; then
@@ -96,7 +97,7 @@ jobs:
           make update-workspace
 
       - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760 # 1.1.0
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
         with:
           repo_secrets: |
             GITHUB_APP_ID=alerting-team:app-id