[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/zizmorcore/zizmor-pre-commit: v1.22.0 → v1.23.1
• github.com/astral-sh/uv-pre-commit: 0.9.28 → 0.11.3
• github.com/astral-sh/ruff-pre-commit: v0.14.13 → v0.15.9

[neutrinoceros]

@kwgoodman the proper fix to the newly discovered zizmor audit (secrets-outside-env) would be to setup trusted publishing and revoke the long-lived pypi token stored in this repo.

[rgommers]

Yes, we should set that up, that is getting more urgent with every supply chain security issue.

Not sure you pinged the right person though, should probably have been @rdbisme.

I'd be inclined to delete the API token now, because that's way too insecure - it can easily be extracted by running CI on a PR. Any objections?

[neutrinoceros]

I picked @kwgoodman as the first name on the maintainer list for the PyPI repo, but really anyone with clearance could step up.
I agree with deleting the token as soon as possible.