Add pinact and zizmor workflow checks

[demeyerthom]

This PR adds two GitHub Actions workflows:

• pinact.yaml: Checks that all GitHub Actions are pinned to full-length commit SHAs
• zizmor.yaml: Runs zizmor to detect security issues in GitHub Actions workflows