use secrets in a dedicated env

[2bndy5]

We appended a # zizmor: ignore[secrets-outside-env] comment to the following lines:

• .github/workflows/py-coverage.yml:42
• .github/workflows/py-publish.yml:44
• .github/workflows/py-publish.yml:51
• .github/workflows/snyk-container.yml:20

To resolve this (and remove the ignore comments), we need to use a dedicated environment for each secret. It will require creating (duplicate) environments in the cpp-linter org repos that call these reusable workflows (with secrets: inherit).

ref: zizmor secrets-outside-env audit rule

Originally posted by @2bndy5 in #71 (comment)