add zizmor-action for GHA static analysis

[ktdreyer]

There are many secrets in this repo. We should investigate adding https://docs.zizmor.sh/usage/ to do static analysis on our GHA-related changes.

[jeremyeder]

Housekeeping: reviewing open issues. @ktdreyer is this still relevant / something you plan to work on? If not, we'll close it out. No pressure either way — just trimming the backlog.