fix: add a test that enforces zizmor checks on our github actions

[jakelorocco]

See if we can add zizmor checks to our PR / tests. And fix all of the issues if any.

[planetf1]

It's an indicator of good practice in supply chain security, and is an example of one of the checks OSSF Scorecard does - linking as one can run scorecard against repos (they do top ones automatically)

[psschwei]

may be done

[jakelorocco]

This should also block PR merges by default.

[planetf1]

PR #1530 adds the zizmor CI gate to the quality.yml reusable workflow, which runs on every PR via ci.yml. The job fails on findings, blocking merges natively (as requested in the comments above).

What the PR does:

• Adds a zizmor job to .github/workflows/quality.yml — pinned SHA, contents: read only, online mode via github.token
• Adds .github/zizmor.yml with per-line suppression rules for pre-existing findings found on first run
• All new violations on any unsuppressed line will fail CI immediately

Pre-existing findings were found across several workflows and are tracked as follow-up issues. Each suppression entry in zizmor.yml links to a rule; the definition of done for each issue is to fix the root cause AND remove the suppression:

Issue	Finding	Files affected
#1533	ref-version-mismatch — stale version comments on SHA pins	7 files, 14 instances
#1531	unpinned-uses + github-app — create-github-app-token@v1 not SHA-pinned, app token permissions unscoped	release workflows
#1532	template-injection — workflow_dispatch inputs used directly in run: blocks	dispatch-to-contribs.yml
#1534	cache-poisoning, excessive-permissions, artipacked — lower-priority, need judgement call	docs-publish.yml, dispatch-to-contribs.yml, publish-release.yml