ci: add zizmor security scan

[tanmayeepemmaraju]

Background

Add Zizmor scanning for GitHub Actions changes, matching the configuration merged in mparticle-web-sdk (mParticle/mparticle-web-sdk#1444) and mparticle-android-sdk (mParticle/mparticle-android-sdk#823).

What Has Changed

• Add a Zizmor workflow for changes under .github/workflows/** and .github/actions/**.
• Run it for main, with manual execution available.
• Pin checkout and Zizmor actions to reviewed commit SHAs.
• Deny permissions by default and grant only contents: read and actions: read to the scan job.
• Preserve the Rokt SDK rollout behavior with continue-on-error: true, so findings appear as annotations without blocking unrelated work.

Validation

• Workflow parsed as YAML and audited with zizmor 1.23.1: the new file reports no findings of its own.
• Formatting matches Prettier defaults, so it passes Trunk in repos that run it.

Screenshots/Video

• N/A

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds a read-only, non-blocking CI workflow for static analysis of GitHub Actions configurations.

Overview
Adds a new GitHub Actions workflow running Zizmor to perform static security analysis on GitHub Actions workflows and custom actions.

The scan triggers on pull requests, pushes to main, and manual dispatches affecting .github/workflows/** or .github/actions/**. It runs in advisory mode (continue-on-error: true) with minimal read-only permissions to surface findings as PR annotations without blocking CI.

^{Reviewed by Cursor Bugbot for commit 029a2c8. Bugbot is set up for automated code reviews on this repo. Configure here.}