Add comment to ignore unpinned uses for version tag action

Author: ahosgood

.github/workflows/cd.yml

@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
       - name: Generate version tag
         id: version-tag
-        uses: nationalarchives/ds-docker-actions/.github/actions/get-version-tag@main
+        uses: nationalarchives/ds-docker-actions/.github/actions/get-version-tag@main # zizmor: ignore[unpinned-uses] Owned by The National Archives
       - name: Build Docker image
         uses: nationalarchives/ds-docker-actions/.github/actions/build@main
         with: