ci: adjust zizmor advanced security handling (#9)

Author: wochinge

.github/workflows/zizmor.yml

@@ -17,9 +17,6 @@ permissions: {}
 jobs:
   zizmor:
     name: Check GitHub Actions security
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       security-events: write
@@ -32,4 +29,5 @@ jobs:
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
         with:
-          advanced-security: true
+          advanced-security: ${{ github.event_name == 'push' && 'true' || 'false' }}
+          min-severity: low