ci: add zizmor security scan

[tanmayeepemmaraju]

Background

Add Zizmor scanning for GitHub Actions changes, matching the configuration merged in mparticle-web-sdk (mParticle/mparticle-web-sdk#1444) and mparticle-android-sdk (mParticle/mparticle-android-sdk#823).

What Has Changed

• Add a Zizmor workflow for changes under .github/workflows/** and .github/actions/**.
• Run it for main, development, with manual execution available.
• Pin checkout and Zizmor actions to reviewed commit SHAs.
• Deny permissions by default and grant only contents: read and actions: read to the scan job.
• Preserve the Rokt SDK rollout behavior with continue-on-error: true, so findings appear as annotations without blocking unrelated work.

Validation

• Workflow parsed as YAML and audited with zizmor 1.23.1: the new file reports no findings of its own.
• Formatting matches Prettier defaults, so it passes Trunk in repos that run it.

Screenshots/Video

• N/A

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds a non-blocking CI security scanner workflow with read-only permissions and no impact on application runtime.

Overview
Adds a new GitHub Actions workflow that runs Zizmor static security analysis on workflow and action file changes.

The scan triggers on pull requests and pushes affecting .github/workflows/** or .github/actions/**, as well as manual dispatches. It runs in advisory mode with continue-on-error: true to post annotations without blocking builds.

^{Reviewed by Cursor Bugbot for commit 67ea72b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tanmayeepemmaraju]

Superseded by #309 — reopened on a ci/ branch to satisfy the semantic branch name check.