fix(ci): add zizmor security linter for github actions

[cclauss]

Checklist

• npm install && npm run lint && npm test passes
• tests are included
• documentation is changed or added
• commit message follows commit guidelines

Description of change

https://docs.zizmor.sh -- zizmor is a static analysis tool that can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit.

Fixes:

• https://docs.zizmor.sh/audits/#artipacked
• https://docs.zizmor.sh/audits/#dependabot-cooldown
• https://docs.zizmor.sh/audits/#persist-credentials
• https://docs.zizmor.sh/audits/#unpinned-uses

After this is merged, if someone has confidence and experience dealing with excessive-permissions, remove the zizmor.yml file and fix all remaining zizmor issues.

I have made regrettable errors trying to fix excessive-permissions, so I am reluctant to fix them in this pull request, which does other useful things.

The Lint Python failure is fixed in:

• fix(ci): do not ruff format gyp example code in markdown files #3357