[cleanup] Misc (#16452)

* Include `pin*` extras in lockfile
* Fix and clean up `devscripts/update_requirements.py`
* Improve release channel documentation
* Remove false statement from `--prefer-insecure` documentation
* Assorted code cleanup
* Set `GH_TELEMETRY=false` in CI/CD whenever `gh` is used
* Add comments about required checks in CI workflows
* Run `test-workflows.yml` for every PR so its checks can be required
* Verify actionlint attestation in CI
* Remove zizmor version to reduce workflow maintenance burden
  (zizmor-action handles pinning on its end)

Authored by: bashonly

.github/workflows/issue-lockdown.yml

@@ -5,9 +5,12 @@ on:
 
 permissions: {}
 
+env:
+  GH_TELEMETRY: "false"
+
 jobs:
   lockdown:
-    name: Issue Lockdown
+    name: Issue lockdown
     if: vars.ISSUE_LOCKDOWN
     permissions:
       issues: write  # Needed to lock issues
@@ -19,4 +22,4 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           REPOSITORY: ${{ github.repository }}
         run: |
-          gh issue lock "${ISSUE_NUMBER}" -R "${REPOSITORY}"
+          gh issue lock -R "${REPOSITORY}" "${ISSUE_NUMBER}"