Enable CI, disable CD

[RaoulSchaffranek]

This pull request removes two existing secret-bearing workflows and replaces them with new or updated workflows for linting and testing, with improved security and updated dependencies.

Key changes:

Workflow removals:

• Deleted the master-push.yml workflow, which previously handled Nix flake releases on pushes to the master branch.
• Deleted the update-version.yml workflow, which handled dependency and version updates on specific branches.

New and improved workflows:

• Added a new lint-workflows.yml workflow to lint GitHub Actions workflows using actionlint and to run the zizmor security tool, improving workflow quality and security checks.
• Updated the test-pr.yml workflow:
  • Improved security by explicitly setting permissions: contents: read and using pinned action versions with SHA references.
  • Replaced the use of cachix-action with direct Nix cache configuration for public caches, simplifying the setup and removing the need for authentication tokens.
  • Updated action steps to use specific versions and improved caching/substitution logic.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.