ci: Run zizmor on GitHub Actions and fix security findings

Description

Run zizmor, a static analysis tool for GitHub Actions, on this repository's workflows to identify and fix security issues. Add zizmor as a CI check.

This follows the same work done in tektoncd/pipeline#9667.

What needs to be done

1. Run zizmor --fix=all . to auto-fix findings:

   • Add persist-credentials: false to all actions/checkout steps (artipacked)
   • Fix template injection by replacing ${{ }} in run: blocks with shell env vars (template-injection)

2. Add zizmor CI workflow (.github/workflows/zizmor.yaml) that runs on pushes to main and PRs, uploading SARIF results to GitHub Advanced Security

3. Fix remaining non-auto-fixable findings manually:

   • Scope permissions to job level instead of workflow level (excessive-permissions)
   • Fix template injection in github-script steps using process.env pattern (template-injection)
   • Replace third-party actions with gh CLI where possible (superfluous-actions)

4. File follow-up issues for any remaining findings that require broader changes (e.g., secrets-outside-env, secrets-inherit)

Reference

• zizmor docs: https://docs.zizmor.sh/
• Reference PR: https://github.com/tektoncd/pipeline/pull/9667

/kind cleanup

Start by running zizmor --fix=all . against the repository's GitHub Actions workflows and review the remaining findings. Add .github/workflows/zizmor.yaml for pushes to main and pull requests, including SARIF upload, then address the listed permissions, template-injection, and superfluous-action findings. Done means the CI check runs and remaining broader findings have follow-up issues.