chore: added zizmor to GH Actions ci workflow

[jurerotar]

Another safety-oriented PR. Zizmor is essentially a linter for GH Actions, if we add any funky settings to them in the future, they should be flagged with this.

https://github.com/zizmorcore/zizmor

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[jurerotar]

Ah, it seems we're already doing it, I wasn't aware. I'll close this PR then 😄

[tomayac]

Perfect, still thanks for the double check.

[jurerotar]

I've decided to re-open this PR. My logic goes that if at any point this additional check that I didn't know about gets turned off, we still have our own version of it 😄

Edit: I've also pinned all actions to their exact commits. When we need to update, we can use https://github.com/suzuki-shunsuke/pinact#update-actions--update

[tomayac]

LGTM