Add zizmor static analysis to CI

Add zizmor workflow security scanner as a CI job to detect
common GitHub Actions misconfigurations and vulnerabilities.
Uses SARIF output for GitHub security tab integration.

A .github/zizmor.yml config allows ref-pinned refs for our
own posit-dev/images-shared/* composite actions while
requiring hash-pinning for all third-party actions.

Author: bschwedler

.github/workflows/ci.yml

@@ -29,10 +29,12 @@ jobs:
       - bakery
       - bakery-native
       - release
+      - zizmor
 
     steps:
       - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # release/v1
         with:
+          allowed-skips: zizmor
           jobs: ${{ toJSON(needs) }}
 
   test:
@@ -132,6 +134,17 @@ jobs:
       context: "./posit-bakery/test/resources/multiplatform/"
       dev-versions: include
 
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8  # v0.5.2
+
   with-macros-clean-caches:
     name: Clean Caches (with-macros suite)
     permissions:

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party composite actions are kept at branch refs
+        # (e.g. @main) intentionally; SHA-pinning them would
+        # defeat the purpose of reusable shared actions.
+        "posit-dev/images-shared/*": ref-pin
+        "*": hash-pin