Chore: [AEA-0000] - use new quality checks

[anthony-nhs]

Summary

• Routine Change

Details

• use new quality checks

[Copilot]

Pull request overview

This PR updates repository quality/security tooling to align with the newer EPS common workflow “quality checks” approach and related local developer checks, while tightening GitHub Actions permissions.

Changes:

• Switch PR/release workflows to the newer eps-common-workflows quality-checks reusable workflow revision and add explicit minimal job permissions.
• Harden GitHub Actions (default permissions: {}, targeted job permissions, and actions/checkout credential persistence tweaks).
• Add/adjust local and repo hygiene tooling (Grype pre-commit hook, Zizmor config, ignore generated security artefact directories, CODEOWNERS for workflows, git-secrets allowlist updates, devcontainer image bump).

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
zizmor.yml	Adds Zizmor rule ignores for known workflow findings.
.pre-commit-config.yaml	Adds a local Grype scan hook.
.gitignore	Ignores .secrets/ and .sbom/ artefact directories.
.github/workflows/update_repo_status_data.yml	Tightens permissions and checkout credential handling while preserving gh-pages publishing.
.github/workflows/sync_copilot.yml	Sets workflow default permissions to none and scopes job permissions.
.github/workflows/release.yml	Moves to newer reusable quality checks and adds explicit permissions per job.
.github/workflows/pull_request.yml	Moves to newer reusable quality checks and adds explicit permissions per job.
.github/CODEOWNERS	Restricts approval of workflow changes to EPS administrators.
.gitallowed	Extends git-secrets allowlist patterns for token-related strings.
.devcontainer/devcontainer.json	Updates the devcontainer image version.

[Copilot]

The new allowlist entries include a duplicate regex (the _get_or_create_gh_auth_token() line is repeated) and an apparently truncated/broad pattern (assert token == ) that could unintentionally suppress secret-detection matches. Please dedupe and tighten/remove the assert token == entry (e.g., only allow a specific non-secret placeholder) so the allowlist remains as narrow as possible.

Suggested change

	token = cli\._get_or_create_gh_auth_token\(\)
	assert token ==
	assert token == "test-token"