[CI] Add Zizmor GitHub Actions security scanning

Author: Kocal

.github/workflows/zizmor.yaml

@@ -0,0 +1,27 @@
+name: Zizmor GitHub Actions security analysis
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - '**'
+
+permissions: {}
+
+jobs:
+    zizmor:
+        name: Run Zizmor
+        runs-on: ubuntu-latest
+        permissions:
+            security-events: write # Required for zizmor-action to upload the SARIF report.
+            contents: read # Needed to clone the repo (private repos).
+            actions: read # Needed for upload-sarif to read workflow run info (private repos).
+        steps:
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Run Zizmor
+              uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7