fix: Run zizmor directly instead of via action to avoid SARIF upload

The zizmorcore/zizmor-action bundles a codeql upload-sarif step that
requires GitHub Advanced Security code scanning regardless of repo
settings. Replace with a plain pip install + zizmor run, which exits
non-zero on findings and needs no special permissions or features.

Author: ocean

.github/workflows/zizmor.yml

@@ -12,14 +12,12 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
       contents: read
-      actions: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        run: pip install zizmor && zizmor .