lint: add zizmor check

[woodruffw]

This adds zizmor to lint.in and runs it as part of bin/lint, i.e. make lint.

This in turn should shorten the loop for local testing. One downside to this is that I think it'll effectively run zizmor twice in CI -- once in the linting job and once again in the dedicated job. We could maybe disable this by adding a make local-lint or similar, or having bin/lint skip zizmor when CI=true.

CC @ewdurbin 🙂