Apply zizmor to more repos in the ecosystem

[stefanv]

scikit-image already uses zizmor; adopt it in other libraries too.

https://github.com/scikit-image/scikit-image/blob/main/.pre-commit-config.yaml#L46

• astropy
• ipython
• matplotlib
• mne
• networkx
• numpy
• pandas
• pydata-sphinx-theme
• pysal
• scikit-hep
• scikit-image
• scikit-learn
• scipy
• xarray
• zarr

[tylerjereddy]

I ran it on the SciPy CI config in the cross-linked ticket, to check their inclination on adopting it.

[matthewfeickert]

This is the first I'm learning of zizmor, but I'm all for static analysis tools. 👍

[tylerjereddy]

The cross-linked analysis in SciPy suggests the tool is prone to false positives at this time. That said, it did lead to the team slightly tightening up our security as a result of the discussion, and providing the upstream author with some reproducible feedback on potential issues. So, I think we are not likely to adopt the tool just yet, but there was some net benefit to poking on the topic a little bit.