add zizmor to existing precommit GHA workflow (#39108)

Author: derrickaw

.github/workflows/beam_PreCommit_GHA.yml

@@ -42,7 +42,7 @@ permissions:
   packages: read
   pages: read
   repository-projects: read
-  security-events: read
+  security-events: write
   statuses: read
 
 # This allows a subsequently queued workflow run to interrupt previous runs
@@ -78,6 +78,10 @@ jobs:
         comment_phrase: ${{ matrix.job_phrase }}
         github_token: ${{ secrets.GITHUB_TOKEN }}
         github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
+    - name: Run zizmor
+      uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+      with:
+        advanced-security: true
     - name: Setup environment
       uses: ./.github/actions/setup-environment-action
       with: