16cb6af605
## Summary Addresses zizmor findings in `build-docker.yml`. Key changes: primarily removing template expansions and restricting some permissions. ## Test Plan Let the CI run. Signed-off-by: William Woodruff <william@astral.sh>