[cleanup] Misc (#16452)

* Include `pin*` extras in lockfile
* Fix and clean up `devscripts/update_requirements.py`
* Improve release channel documentation
* Remove false statement from `--prefer-insecure` documentation
* Assorted code cleanup
* Set `GH_TELEMETRY=false` in CI/CD whenever `gh` is used
* Add comments about required checks in CI workflows
* Run `test-workflows.yml` for every PR so its checks can be required
* Verify actionlint attestation in CI
* Remove zizmor version to reduce workflow maintenance burden
  (zizmor-action handles pinning on its end)

Authored by: bashonly

.github/workflows/challenge-tests.yml

@@ -1,6 +1,7 @@
 name: Challenge Tests
 on:
   push:
+    branches: ['master']
     paths:
       - .github/workflows/challenge-tests.yml
       - test/test_jsc/*.py
@@ -9,6 +10,7 @@ on:
       - yt_dlp/extractor/youtube/pot/**.py
       - yt_dlp/utils/_jsruntime.py
   pull_request:
+    branches: ['**']
     paths:
       - .github/workflows/challenge-tests.yml
       - test/test_jsc/*.py
@@ -25,7 +27,7 @@ concurrency:
 
 jobs:
   tests:
-    name: Challenge Tests
+    name: Challenge tests
     if: ${{ !contains(github.event.head_commit.message, ':ci skip') }}
     permissions:
       contents: read