Add pinact and zizmor workflow checks

[demeyerthom]

This PR adds two GitHub Actions workflows:

• pinact: Checks that all GitHub Actions are pinned to commit SHAs
• zizmor: Runs security analysis on GitHub Actions workflows

[Copilot]

Pull request overview

Adds automated GitHub Actions workflow security checks (pinning verification and zizmor analysis) and updates existing workflows to use pinned action SHAs.

Changes:

• Add new pinact workflow to verify all GitHub Actions usages are pinned to commit SHAs.
• Add new zizmor workflow to run GitHub Actions workflow security analysis.
• Update multiple existing workflows to pin uses: references to specific commit SHAs (and adjust some workflow settings/conditions).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/zizmor.yaml	New workflow to run zizmor on workflow/action changes and on main pushes.
.github/workflows/pinact.yaml	New workflow to verify action pinning on workflow/action changes.
.github/workflows/triage.yaml	Pin third-party and GitHub actions to SHAs.
.github/workflows/tests.yaml	Pin actions to SHAs; tweak setup-go configuration.
.github/workflows/release.yaml	Pin actions to SHAs; tweak setup-go configuration.
.github/workflows/dependabot-changie.yaml	Pin actions to SHAs and adjust Dependabot-only gating condition.
.github/workflows/copilot-setup-steps.yaml	Pin actions to SHAs; tweak setup-go configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

pinact job-level if references github.event.pull_request..., but this workflow also runs on push to main. On push events github.event.pull_request is undefined, so the expression can fail evaluation and break the workflow on every push. Either remove the push trigger, or guard the condition (e.g., check github.event_name == 'pull_request' before accessing github.event.pull_request).

Suggested change

	if: github.event.pull_request.head.repo.full_name == github.repository
	if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository