chore(ci): add Zizmor security analysis

[Ben Challis (ben-challis)]

Summary

• run Zizmor 1.29.0 as a blocking CI audit through the allow-listed official zizmorcore/zizmor-action
• remove persisted checkout credentials and restrict workflow permissions
• scope the GitHub App token used for releases
• retain the repository convention of version-pinning Lendable-owned actions

Stack

This PR is based on #498 and should be reviewed and merged after it.

Verification

• actionlint -color
• zizmor 1.29.0 --format github .
• official Zizmor action CI audit

[aikido-pr-checks]

Binary, code or archive is pulled from a remote source without integrity verification - medium severity
A GitHub Actions Workflow was built using an artifact from a remote source without any integrity verification. If the remote artifact were silently replaced with a malicious version (for example, through a supply chain attack), the integrity and confidentiality of the environment in which the container is deployed could be compromised.

Show fix

Remediation: Validate the artifact against a trusted SHA-512 checksum in the CI/CD pipeline using sha512sum in check mode. Store the expected checksum in a file (e.g., artifact.sha512), then verify it with: sha512sum -c artifact.sha512. Enable strict error handling (for example, set -e in shell scripts) so the pipeline fails if verification fails or outputs errors.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[Ben Challis (ben-challis)]

Aikido Security (@AikidoSec) ignore: False positive: the downloaded Zizmor v1.29.0 archive is verified against its pinned published SHA-256 digest before extraction.

[aikido-pr-checks]

✅ Based on your feedback, we ignored this issue because of the following reason:

False positive: the downloaded Zizmor v1.29.0 archive is verified against its pinned published SHA-256 digest before extraction.