ci: add zizmor security scan

[tanmayeepemmaraju]

Background

Add Zizmor scanning for GitHub Actions changes, matching the configuration merged in mparticle-web-sdk (mParticle/mparticle-web-sdk#1444) and mparticle-android-sdk (mParticle/mparticle-android-sdk#823).

What Has Changed

• Add a Zizmor workflow for changes under .github/workflows/** and .github/actions/**.
• Run it for main, development, with manual execution available.
• Pin checkout and Zizmor actions to reviewed commit SHAs.
• Deny permissions by default and grant only contents: read and actions: read to the scan job.
• Preserve the Rokt SDK rollout behavior with continue-on-error: true, so findings appear as annotations without blocking unrelated work.

Validation

• Workflow parsed as YAML and audited with zizmor 1.23.1: the new file reports no findings of its own.
• Formatting matches Prettier defaults, so it passes Trunk in repos that run it.

Screenshots/Video

• N/A

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds a standalone, non-blocking CI workflow with read-only permissions and no impact on application runtime code.

Overview
Adds a new Zizmor Security Scan GitHub Actions workflow (.github/workflows/zizmor.yml) to audit workflow files and composite actions for security issues.

The workflow triggers on pull requests and pushes targeting main and development when workflow or action files change. It runs in advisory mode with continue-on-error: true and read-only permissions, emitting PR annotations without blocking builds.

^{Reviewed by Cursor Bugbot for commit 67ea72b. Bugbot is set up for automated code reviews on this repo. Configure here.}