ci: remediate zizmor findings

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Resolves existing findings from the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, release/*, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

Zizmor remediation

This change also resolves findings from these zizmor rules:

• artipacked
• template-injection

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Confirm open-telemetry/admin continues to require zizmor code scanning for this repository.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[Copilot]

Pull request overview

This PR tightens GitHub Actions security posture and remediates zizmor findings by preventing persisted checkout credentials and reducing expression expansion in shell command arguments, while keeping code scanning/reporting behavior intact.

Changes:

• Disable persisted actions/checkout credentials across multiple workflows (persist-credentials: false).
• Refactor a Gradle invocation to pass dynamic values via environment variables instead of direct workflow expression interpolation.
• Add gh auth setup-git where needed to support authenticated git operations (partially), aligning with zizmor remediation guidance.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/reusable-lint-check.yml	Disables persisted checkout credentials for lint workflow.
.github/workflows/release.yml	Disables persisted checkout credentials in release workflows; needs explicit git auth setup for later pushes.
.github/workflows/prepare-release-branch.yml	Disables persisted checkout credentials; one job that later pushes now needs explicit git auth setup.
.github/workflows/issue-management-feedback-label.yml	Disables persisted checkout credentials for issue label automation workflow.
.github/workflows/gradle-wrapper-validation.yml	Disables persisted checkout credentials for wrapper validation workflow.
.github/workflows/fossa.yml	Disables persisted checkout credentials for FOSSA scan workflow.
.github/workflows/codeql.yml	Disables persisted checkout credentials for CodeQL workflow.
.github/workflows/build-common.yml	Disables persisted checkout credentials; refactors Gradle args to use env vars to avoid template-injection concerns.
.github/workflows/auto-update-semconv.yml	Disables persisted checkout credentials; adds gh auth setup-git for authenticated pushes when creating PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[trask]

cc @trask to review first