ci: add Security Scan stub (zizmor via reusable org workflow) (aws-deadline#252)

* ci: fix all high-severity zizmor findings in workflows

Suppress 2 high-severity zizmor dangerous-triggers findings that are
intentional design:

- dangerous-triggers (2): claude_pr_review.yml and on_opened_pr.yml both
  use workflow_run, which runs from the default branch with this repo's
  context (never a fork's copy). Fork PRs cannot alter behavior or access
  secrets, so the trigger is safe here. Added inline
  # zizmor: ignore[dangerous-triggers] with justification.

No unpinned-uses findings: all uses: refs are internal
aws-deadline/*@mainline reusable workflows, allowed as ref-pin by the
central config.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>

* ci: add Security Scan stub calling the reusable org workflow

Adds .github/workflows/security_scan.yml, a thin stub that calls the
central reusable_security_scan.yml in aws-deadline/.github@mainline.
Gates PRs on high-severity zizmor findings; new central checks apply
automatically with no per-repo change.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>

---------

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>

Author: crowecawcaw

.github/workflows/claude_pr_review.yml

@@ -11,7 +11,7 @@
 # workflow_run identifiers and the role-ARN secret.
 name: Claude PR Review
 
-on:
+on: # zizmor: ignore[dangerous-triggers] -- workflow_run is intentional and safe here; see the header comment above (runs from default branch, fork PRs cannot alter behavior/secrets)
   workflow_run:
     workflows: ["Claude PR Review (collect)"]
     types:

.github/workflows/on_opened_pr.yml

@@ -1,6 +1,9 @@
 name: On Opened PR
 
-on:
+on: # zizmor: ignore[dangerous-triggers]
+  # workflow_run is intentional: it runs from the default branch with this
+  # repo's context (never a fork's copy), and only consumes the PR artifact via
+  # the reusable extract-PR-details workflow. A fork PR cannot alter behavior.
   workflow_run:
     workflows: ["Record PR"]
     types:

.github/workflows/security_scan.yml

@@ -0,0 +1,21 @@
+name: "Security Scan"
+
+on:
+  push:
+    branches: [ "mainline", "feature_*", "patch_*" ]
+  pull_request:
+    branches: [ "mainline", "feature_*", "patch_*" ]
+  schedule:
+    - cron: '0 8 * * MON'
+
+jobs:
+  Scan:
+    name: Scan
+    # Central, extensible security-scan workflow (currently zizmor). New checks
+    # added there apply here automatically — no change needed to this stub.
+    uses: aws-deadline/.github/.github/workflows/reusable_security_scan.yml@mainline
+    permissions:
+      # The reusable workflow checks out this repo and fetches the central
+      # zizmor config, and reports findings to the run log / PR annotations
+      # (not the Security tab), so it only needs read access.
+      contents: read