Add zizmor GitHub Actions workflow for CI security analysis

[jonathan343]

Overview

This PR adds a Zizmor GitHub Actions workflow to scan this repository's workflows for common security issues.

zizmor is a static analysis tool for GitHub Actions. It helps detect insecure workflow patterns such as overly broad permissions, unsafe triggers, and unpinned or risky action usage.

I've used zizmor to address the following issues with auto-fixes available:

• [dependabot-cooldown]: insufficient cooldown in Dependabot updates
• [artipacked]: credential persistence through GitHub Actions artifacts
• [template-injection]: code injection via template expansion

I also manually addressed the following types of findings:

• [excessive-permissions]: overly broad permissions
  • I following this guidance from zizmor: "In practice, this means that workflows should almost always set permissions: {} at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed."
• [unpinned-uses]: unpinned action reference
  • I pinned all actions to commit SHAs

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.