Run zizmor scan of GitHub actions

[tcompa]

I am ignoring the following warning

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> [...]/fractal-tasks-template/project/.github/workflows/build_and_test.yml.jinja:3:1
   |
 3 | / on:
 4 | |   push:
...  |
11 | |   release:
12 | |     types: [published]
   | |______________________^ generally used when publishing artifacts generated at runtime
13 |
...
37 |           uses: actions/setup-python@v5
38 | /         with:
39 | |           python-version: ${{ '{{' }} matrix.python-version {{ '}}' }}
40 | |           cache: "pip"
   | |______________________^ opt-in for caching here
   |
   = note: audit confidence → Low

because the cache is used for testing, while the deployment part is a different GitHub action job.