[3.12] Add zizmor to pre-commit and fix most findings (GH-127749) (#127788)

(cherry picked from commit ae31df3)

Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Alex Waygood <[email protected]>
Co-authored-by: Ezio Melotti <[email protected]>

Author: 3 people

.github/workflows/reusable-windows-msi.yml

@@ -24,4 +24,5 @@ jobs:
       with:
         persist-credentials: false
     - name: Build CPython installer
-      run: .\Tools\msi\build.bat --doc -"${ARCH}"
+      run: ./Tools/msi/build.bat --doc -"${ARCH}"
+      shell: bash