ci: add zizmor security scan

[tanmayeepemmaraju]

Background

Add Zizmor scanning for GitHub Actions changes, matching the configuration merged in mparticle-web-sdk (mParticle/mparticle-web-sdk#1444) and mparticle-android-sdk (mParticle/mparticle-android-sdk#823).

What Has Changed

• Add a Zizmor workflow for changes under .github/workflows/** and .github/actions/**.
• Run it for main, with manual execution available.
• Pin checkout and Zizmor actions to reviewed commit SHAs.
• Deny permissions by default and grant only contents: read and actions: read to the scan job.
• Preserve the Rokt SDK rollout behavior with continue-on-error: true, so findings appear as annotations without blocking unrelated work.

Validation

• Workflow parsed as YAML and audited with zizmor 1.23.1: the new file reports no findings of its own.
• Formatting matches Prettier defaults, so it passes Trunk in repos that run it.

Screenshots/Video

• N/A

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds a read-only, non-blocking CI security scanning workflow with minimal permissions.

Overview
Adds a new GitHub Actions workflow using zizmor to statically scan workflow and action files for security issues on pushes, pull requests, and manual triggers.

The scan runs in advisory mode with pinned action SHAs and minimal read-only permissions, surfacing findings as PR annotations without blocking builds.

^{Reviewed by Cursor Bugbot for commit 5c0ceb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tanmayeepemmaraju]

Superseded by #54 — reopened on a ci/ branch to satisfy the semantic branch name check.