ci: add Zizmor workflow

Zizmor (https://docs.zizmor.sh/) is a static analysis tool for GitHub
Actions. Most of the issues identified by Zizmor were fixed in #27642.
This Zizmor action integrates with GitHub Advanced Security and scans
workflows for potential security issues, which should help ensure that
such issues aren't reintroduced in the future.

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: 'zizmor: GitHub Actions Security Analysis'
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-24.04
+    permissions:
+      security-events: write # to create vulnerability alerts
+      contents: read # to read repo contents
+      actions: read # to read GitHub actions info
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0