Perform static analysis of GitHub actions

[sormuras]

Perform static analysis of GitHub actions declared in this repository with zizmor:

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution

• Accidental credential persistence and leakage
• Excessive permission scopes and credential grants to runners
• Impostor commits and confusable git references
• ...and much more!

Deliverables

• Install and run https://github.com/zizmorcore/zizmor
• Address findings, if any