ci: Enable Zizmor scans

[adimoft]

This pull request adds a new GitHub Actions workflow to enable automated security scanning using Zizmor. The workflow is triggered on pushes and pull requests to the main branch, as well as on manual dispatch, and uploads scan results to GitHub Security and as a build artifact.

Security scanning automation:

• Added .github/workflows/zizmor.yml to run Zizmor security scans on the codebase during CI, generating a SARIF report and uploading results to GitHub Security and as an artifact.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Changes incorporated

[Copilot]

Pull request overview

This PR introduces a new GitHub Actions workflow to run Zizmor security scanning on GitHub-related files, generate a SARIF report, and publish the results to GitHub code scanning and as a workflow artifact.

Changes:

• Added a new Zizmor Scan workflow triggered on push/pull_request to main and workflow_dispatch.
• Runs Zizmor via uvx to produce a SARIF report.
• Uploads SARIF results to GitHub Security and uploads the report as an artifact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.