add zizmor to scan workflows

[davidism]

https://docs.zizmor.sh/

Among the findings:

• apply empty permissions with permissions: {}, although we have read only defaults set at the organization level
• use concurrency group for each workflow
• disable credentials for checkout
• remove some template variables in favor of env vars