chore(precommit): scope zizmor hook to workflows, actions and dependabot

The zizmor pre-commit hook used `files: ^\.github/`, which matched any
file under `.github/` — including issue templates, the labeler config,
CODEOWNERS, etc. zizmor only audits GitHub Actions workflows, composite
actions and Dependabot configs, so on any commit that touched a
non-auditable `.github/` file it failed with `exit code 3`:

    failed to validate input as workflow: input does not match expected
    validation schema
    fatal: no audit was performed
    error: no inputs collected

Narrow the regex to `^\.github/(workflows|actions)/.+\.ya?ml$|^\.github/dependabot\.ya?ml$`
so zizmor only inspects what it can audit. Verified locally: the hook
skips on `.github/ISSUE_TEMPLATE/*.yml` and the manifest file itself,
and still runs (and passes) on `.github/workflows/api-bump-version.yml`.

.pre-commit-config.yaml

@@ -44,7 +44,12 @@ repos:
     rev: v1.24.1
     hooks:
       - id: zizmor
-        files: ^\.github/
+        # Scope to the inputs zizmor actually audits: workflows, composite
+        # actions, and dependabot config. The previous `^\.github/` regex
+        # also matched issue templates / labeler / CODEOWNERS, which made
+        # zizmor exit 3 ("no audit was performed") on commits that touch
+        # those files.
+        files: ^\.github/(workflows|actions)/.+\.ya?ml$|^\.github/dependabot\.ya?ml$
         priority: 30
 
   ## BASH