ci: integrate zizmor workflow security gate into iOS CI

Add a dedicated workflow-security job to the shared iOS build workflow to enforce GitHub Actions security auditing with [zizmor](https://github.com/zizmorcore/zizmor), and make it a hard gate for the rest of the pipeline.

Author: screendriver

.github/workflows/test_pr_changes.yml

@@ -6,16 +6,56 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  pull-requests: write
+  checks: write
+
 # This is what will cancel the workflow
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  workflow-security:
+    name: Workflow security analysis
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read # required for actions/checkout to read workflow sources
+      actions: read # required for zizmor online audits in private repositories
+      security-events: write # required for SARIF upload
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        id: zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          inputs: .github/workflows/test_pr_changes.yml
+          version: 1.25.2
+          persona: pedantic
+          min-severity: informational
+          min-confidence: low
+          config: .github/zizmor.yml
+
+      - name: Fail if zizmor reported findings
+        env:
+          sarifFilePath: ${{ steps.zizmor.outputs.output-file }}
+        run: |
+          findingsCount="$(jq '[.runs[].results[]] | length' "$sarifFilePath")"
+          echo "zizmor findings: $findingsCount"
+          test "$findingsCount" -eq 0
+
   # This job will tell us which frameworks have source code changes.
   # We'll use the results to run tests only for changed frameworks.
   detect-changes:
     name: Detect PR Changes
+    needs: [workflow-security]
     if: ${{ github.event.pull_request.draft != true }}
     runs-on: ubuntu-24.04
     # Set job outputs to values from filter step

.github/zizmor.yml

@@ -0,0 +1,12 @@
+---
+# All audits run with defaults; only configurable audits are overridden below.
+# Persona, severity floor, and confidence floor are set in workflow files.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': hash-pin
+
+  secrets-outside-env:
+    config:
+      allow: []