CI: Add zizmor workflow audit for unpinned actions

[kevinjqliu]

Part of #15742
We've already moved all references to pinned commit hash in #15753

This adds a CI workflow that uses zizmor to detect unpinned third-party GitHub Actions in workflow files.
Future violations will trigger this CI to fail.

Problem

Actions referenced by mutable tag (e.g. actions/checkout@v4) can be silently replaced by a compromised or force-pushed tag, allowing arbitrary code execution inside CI. All uses: references should be pinned to a full commit SHA to make them immutable and auditable.

Solution

Add a zizmor.yml workflow that:

• Triggers on PRs that modify .github/workflows/**
• Runs zizmor in offline mode to check for unpinned-uses findings
• Reports the file, line, and action for each violation
• Fails the check if any unpinned actions are found

Testing

Ran CI on forked repo w/ a tagged pin, kevinjqliu#14
Fails CI ✅ https://github.com/kevinjqliu/iceberg/actions/runs/23516762295/job/68450916216?pr=14

Error: Found unpinned GitHub Actions:
.github/workflows/open-api.yml:49:15	astral-sh/setup-uv@v7
Error: Process completed with exit code 1.

[kevinjqliu]

This isn't the prettiest, but it does isolate the unpinned-use error

[RussellSpitzer]

why don't we want to do the "security-events" write ?

[kevinjqliu]

we will eventually. This is just gate regression for 1 specific issue (unpinned-uses)

we already fixed it in #15707

[kevinjqliu]

once we burn down the warnings from zizmor, we can enforce everything using the zizmor github action (https://github.com/marketplace/actions/zizmor-action)

[steveloughran]

the fact the zizmor found an unpinned reference is a successful test run: it shows it works

[huaxingao]

Nit: 2>/dev/null hides errors, if zizmor fails to run, $findings will be empty and the check will silently pass. Maybe remove it or check the exit code first?

[stevenzwu]

should we include all items with high severity and high confidence?

      "confidence": "High",
      "severity": "High",

Or is unpinned-uses just the first step?

[kevinjqliu]

superseded by #15793