ci: add zizmor config exempting first-party reusables

zizmor's default unpinned-uses policy is blanket hash-pin, which flags every
netresearch/* reusable referenced @main — including the scanner jobs added in
this PR. First-party reusables track @main by policy so fixes propagate to all
consumers, so they are exempted to ref-pin here.

Third-party actions remain hash-pin enforced. Byte-identical to the shared
template config (netresearch/.github#329).

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/zizmor.yml

@@ -0,0 +1,13 @@
+# zizmor (https://zizmor.sh) configuration
+#
+# Tunes zizmor to Netresearch conventions so the audit reports only
+# actionable findings. Third-party actions remain hash-pin enforced.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party reusable workflows track @main by policy and are
+        # never SHA-pinned, so fixes propagate to all consumers.
+        "netresearch/*": ref-pin
+        # Everything else must be pinned to a full commit SHA.
+        "*": hash-pin