ci: add zizmor security scan

[tanmayeepemmaraju]

Background

Add Zizmor scanning for GitHub Actions changes, matching the configuration merged in mparticle-web-sdk (mParticle/mparticle-web-sdk#1444) and mparticle-android-sdk (mParticle/mparticle-android-sdk#823).

What Has Changed

• Add a Zizmor workflow for changes under .github/workflows/** and .github/actions/**.
• Run it for main, with manual execution available.
• Pin checkout and Zizmor actions to reviewed commit SHAs.
• Deny permissions by default and grant only contents: read and actions: read to the scan job.
• Preserve the Rokt SDK rollout behavior with continue-on-error: true, so findings appear as annotations without blocking unrelated work.

Validation

• Workflow parsed as YAML and audited with zizmor 1.23.1: the new file reports no findings of its own.
• Formatting matches Prettier defaults, so it passes Trunk in repos that run it.

Screenshots/Video

• N/A

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds a non-blocking CI security scanner with minimal read-only permissions, having no impact on production code.

Overview
Adds a new GitHub Actions workflow to run Zizmor security analysis on workflow and action changes targeting main.

The workflow runs with read-only permissions and operates in non-blocking advisory mode (continue-on-error: true) to surface findings as PR annotations without failing builds.

^{Reviewed by Cursor Bugbot for commit 029a2c8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tanmayeepemmaraju]

Superseded by #104 — reopened on a ci/ branch to satisfy the semantic branch name check.