Scan GitHub Actions workflows with zizmor

[hocinehacherouf]

Problem

The repo scans source code with Trivy but doesn't scan its own GitHub Actions workflows. CI/CD is a common
supply-chain attack surface (overprivileged tokens, unpinned actions, template-injection sinks) and currently goes
uncovered.

Suggestion

Add a dedicated .github/workflows/zizmor.yml workflow running the official zizmorcore/zizmor-action
(https://docs.zizmor.sh/integrations/#via-zizmorcorezizmor-action). Triggered on push to main and on pull_request
(both path-filtered to .github/workflows/**) so workflow changes are scanned pre-merge, plus a weekly schedule to
catch newly-disclosed issues in pinned actions, plus workflow_dispatch. SARIF uploaded to the Security tab like Trivy
does.

Alternatives Considered

• GitHub's actionlint: catches YAML/shell syntax issues but not security misconfigurations (token scopes, injection
  sinks).
• StepSecurity Harden-Runner: runtime egress monitoring rather than static analysis; complementary, not a
  replacement.
• OpenSSF Scorecard: repo-level security posture metrics, doesn't audit individual workflow logic.

Additional Context

Docs: https://docs.zizmor.sh