zizmor checks cleanup (1) (#46646)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41198

Fixing/enabling these zizmor checks:
- dependabot-cooldown
- secrets-inherit
- unpinned-uses


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Refined secret handling in CI test workflows: replaced inherited
secrets with explicit secret mappings and conditional forwarding
(scheduled runs vs others).
* Declared additional callable secrets for the reusable test suite: a
GitHub token and a Slack webhook for scheduled-run notifications.
* Updated blocking gate configuration: adjusted which rules are shown as
disabled and updated finding count comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/test-go-activity.yaml

@@ -58,7 +58,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -76,7 +78,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # We upload all backend coverage in one step so that we're less likely to end up with a partial coverage report.
   upload-coverage:

.github/workflows/test-go-suite.yaml

@@ -29,6 +29,13 @@ on:
         required: false
         type: boolean
         default: false
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT:
+        description: 'GitHub PAT used as NETWORK_TEST_GITHUB_TOKEN for tests that hit the GitHub API.'
+        required: false
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL:
+        description: 'Slack webhook for notifying on scheduled (cron) run failures.'
+        required: false
 
 permissions:
   contents: read

.github/workflows/test-go.yaml

@@ -64,7 +64,9 @@ jobs:
     with:
       suite: ${{ matrix.suite }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Suites that need MySQL: always-run versions (every push/PR + cron).
@@ -80,7 +82,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -97,7 +101,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # Based on https://github.com/micromdm/nanomdm/blob/main/.github/workflows/on-push-pr.yml#L87
   test-go-nanomdm:

.github/zizmor-gate.yml

@@ -12,11 +12,9 @@
 # .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
 
 rules:
-  artipacked: # 125 findings
+  artipacked: # 112 findings
     disable: true
-  dependabot-cooldown: # 2 findings
-    disable: true
-  excessive-permissions: # 20 findings
+  excessive-permissions: # 6 findings
     disable: true
   known-vulnerable-actions: # 418 findings (online audit)
     disable: true
@@ -24,9 +22,5 @@ rules:
     disable: true
   ref-version-mismatch: # 44 findings (online audit)
     disable: true
-  secrets-inherit: # 5 findings
-    disable: true
   template-injection: # 234 findings
     disable: true
-  unpinned-uses: # 31 findings
-    disable: true