Merge branch 'master' into fix/security-zizmor-self-repository-presto-celery

The `Start Celery worker` step in the `test-postgres-presto` job
references `.github/actions/cached-dependencies` via the
workspace-relative `uses: ./...` syntax. zizmor's `self-repository`
audit flags this in favor of `uses: $/...`, but `cached-dependencies`
is a git submodule and the `$/` syntax resolves action files directly
from the repository tree without a submodule-aware checkout, so it
can't see past the submodule's gitlink into the actual action.yml.

This mirrors the same documented false-positive pattern already used
for this action elsewhere in the repo (superset-translations.yml),
suppressing it with a scoped `zizmor: ignore[self-repository]` comment.

Resolves code-scanning alert #2665

.github/workflows/superset-python-presto-hive.yml

@@ -86,7 +86,13 @@ jobs:
         with:
           run: setup-postgres
       - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's link. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: celery-worker
       - name: Python unit tests (PostgreSQL)