workflows: address zizmor findings, add zizmor workflow #2

	name: GitHub Actions Security Analysis with zizmor 🌈

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["**"]

	jobs:
	zizmor:
	name: zizmor latest via Cargo
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	# required for workflows in private repositories
	contents: read
	actions: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	persist-credentials: false
	- name: Setup Rust
	uses: actions-rust-lang/setup-rust-toolchain@v1
	- name: Get zizmor
	run: cargo install zizmor
	- name: Run zizmor 🌈
	run: zizmor --format sarif . > results.sarif
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: results.sarif
	category: zizmor

Provide feedback