use zizmor to lint GitHub actions

[mockersf]

Objective

• Improve security of Bevy CI

Solution

• Use zizmor to lint actions https://github.com/zizmorcore/zizmor
• Fix a few lints
  • pin actions
  • specify persist-credentials
  • set write permissions at job level instead of workflow level
  • set target branch for pull_request_target workflows
• Add the linter as CI. With the proposed config, it should report potential issues in the security center and not block merging. There are still a few lints that fail and need more rework to fix

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[LikeLakers2]

@mockersf I'm not sure of the point of marking #22294 (review) as resolved? It clearly wasn't resolved...

[mockersf]

It is for me

[mockersf]

It's configured to not fail CI but to report issues in the security center in github

That's the recommended configuration, and it made sense at the time because we have a few unresolved issues and I didn't want to block CI on it

Not sure there's anyone else than me that looks at that tab though, and only maintainers have access to it I think