chore: add zizmor

[ilan-gold]

• Closes #
• Tests added

• Release note not necessary because: dev

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.70%. Comparing base (c87dc0a) to head (eaae3a3).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2413   +/-   ##
=======================================
  Coverage   85.69%   85.70%           
=======================================
  Files          49       49           
  Lines        7793     7805   +12     
=======================================
+ Hits         6678     6689   +11     
- Misses       1115     1116    +1     

see 5 files with indirect coverage changes

[flying-sheep]

dependabot/dependabot-core#14349

[ilan-gold]

cc @Intron7 could you have a look at the failing GPU tests