[3.13] Add zizmor to pre-commit and fix most findings (#127749)#127786