Add zizmor checks and fix all lints

[ocefpaf]

@hansthen I'll prepare the PR to fetch the supporting data from a release afte this one. I had this sitting on my laptop for a long time.

[ocefpaf]

We need to either find another source for the WMS time plugin or we need to remove it from the docs. The source we are using there is failing and prevent us from building the docs.

    ConnectTimeout: HTTPSConnectionPool(host='pae-paha.pacioos.hawaii.edu', port=443): Max retries exceeded with url: /thredds/wms/dhw_5km?service=WMS&request=GetCapabilities&version=1.1.1 (Caused by ConnectTimeoutError(<HTTPSConnection(host='pae-paha.pacioos.hawaii.edu', port=443) at 0x7ff7942367b0>, 'Connection to pae-paha.pacioos.hawaii.edu timed out. (connect timeout=100)'))

@hansthen are you OK with removing this part of the docs?

[hansthen]

@hansthen are you OK with removing this part of the docs?
Yes. Do you want me to remove it in a separate PR or will you make it part of this one?

[ocefpaf]

Yes. Do you want me to remove it in a separate PR or will you make it part of this one?

I can do it after this one. I'm still looking for alternatives and/or keeping some parts of the example alive without reaching the URL. More on that soon.

Let me know if you are OK with this PR and I'll tackle the docs+downloadable assets right after.

[hansthen]

Why is this required? I take it the long string is a version hash? What will this mean for future maintenance?

[ocefpaf]

Dependabot should update those automatically, and the comment with the human readable version.

This is necessary b/c only a hash is immutable, the releases are not. It is one of the security checks that zizmor does.

[ocefpaf]

BTW GitHub did introduce immutable releases recently, but those are optional and it is not worth checking each project to ensure they are using it or not. The recommendation is to still use the hashes.

[hansthen]

Yes. Do you want me to remove it in a separate PR or will you make it part of this one?

I can do it after this one. I'm still looking for alternatives and/or keeping some parts of the example alive without reaching the URL. More on that soon.

Let me know if you are OK with this PR and I'll tackle the docs+downloadable assets right after.

I'm okay with it. I just had one question (why the long version hashes are required).

[ocefpaf]

I'll address the docs failure next.