Use GitHub Actions

[jmsmtn]

Use GitHub Actions

I think that Travis CI is no longer used, since I think Travis CI stopped supporting open source projects sometime in 2020. This PR seeks to replace Travis CI with GitHub Actions.

While /pull/816 exists, it is fairly old. This PR tries to revive that effort in order to make this project easier to contribute to, maintain, and release.

Note: I'm not experienced with GitHub Actions - I mainly work with GitLab CI. But, I will bear any YAML burden here because CI is so important.

What your changes do and why you chose this solution

This PR introduces some GitHub Action workflows:

• tests.yml - Run tests for Python versions 3.9 to 3.14. This doesn't use tox, but if needed I can easily change it to use tox.
• checks.yml - for miscellaneous checks - right now to check that Poetry and it's lockfile is in a good state
• lints.yml - Runs black, isort, and flake8.
  • I ran black and isort formats. The flake8 job will not fail, currently. It has some 200 items to resolve so I thought it would be best to make that a separate PR.
• release-github.yml - Handle github releases
• zizmor.yml - Warn on any security issues with GitHub actions. I recently read Github Actions is the weakest link so some of these workflows have been changed for security reasons.
• release-pypi.yml - Handle pypi and testpypi deployments. Tested with at Use GitHub Actions jmsmtn/pysaml2#1 and in test pypi and pypi

ACTIONS REQUIRED BY MAINTAINERS: In order to use the release-pypi.yml, trusted publishing must be setup in test.pypi.org and pypi.org. Having never done it myself, I thought that this was surprisingly easy to setup, but if it's too much right now, we can always remove the release-pypi.yml action.

Checklist

• Checked that no other issues or pull requests exist for the same issue/change
  • Github Actions #816 also addresses this, but it's pretty old, this PR might help
• Added tests covering the new functionality
  • n/a
• Updated documentation OR the change is too minor to be documented
• Updated CHANGELOG.md OR changes are insignificant