chore: annotate zizmor warnings

Author: nijel

.github/workflows/docker.yml

@@ -34,8 +34,8 @@ jobs:
       if: github.event_name != 'pull_request'
       uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
       with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
+        username: ${{ secrets.DOCKERHUB_USERNAME }}  # zizmor: ignore[secrets-outside-env]
+        password: ${{ secrets.DOCKERHUB_TOKEN }}  # zizmor: ignore[secrets-outside-env]
 
     - name: Login to GHCR
       if: github.event_name != 'pull_request'

.github/workflows/tag.yml

@@ -19,7 +19,7 @@ jobs:
     - name: 🏷️ Create/update tag
       uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       with:
-        github-token: ${{ secrets.WEBLATE_CI_TOKEN }}
+        github-token: ${{ secrets.WEBLATE_CI_TOKEN }}  # zizmor: ignore[secrets-outside-env]
         script: |
           const now = new Date;
           const onejan = new Date(now.getFullYear(), 0, 1);