add zizmor-action for GHA static analysis

[ktdreyer]

Now that we're many more secrets and authorizations to this repo, we should investigate adding https://docs.zizmor.sh/usage/ to do static analysis on our GHA-related changes.