It might be worth adding zizmor as a GitHub action

[graingert]

          It might be worth adding it as a GitHub action because I think it can catch more issues if it is passed a GITHUB_TOKEN.

Originally posted by @A5rocks in #3154 (comment)