`zizmor`: templating

[bjlittle]

📰 Custom Issue

Reference: #6809

Require to investigate the insecure use of on: pull_request_target within the iris/.github/workflows/ci-template-check.yml GHA and consider alternatives.

❗ Also applies to workflows/.github/workflows/ci-template-check-pr.yml.

Ideally we should be using on: pull_request, however this may break the entire template workflow.

In the meantime, an explicit # zizmor: ignore[dangerous-triggers] exception has been added to ci-template-check.yml.

Also see https://docs.zizmor.sh/audits/#dangerous-triggers

[trexfeathers]

posting comments on PRs is nasty - either pull_request_target or split workflow with JavaScript. We have two workflows that need this - templating and benchmarking - so we could make it less yucky by creating a convenience workflow for posting comments on PRs. Both workflows could communicate with it via safe artifacts.