ci: add reusable GitHub Actions security scanning

[setchy]

Summary

• Add a reusable workflow_call zizmor scanner for the calling repository's workflows/actions, with pinned actions and non-persistent checkout credentials.
• Support SARIF uploads (category zizmor) and read-only annotation mode; fork PRs always use annotations without privileged triggers or tokens.
• Intentionally inherit the caller's explicitly scoped job token. The caller defaults to permissions: {} and grants only mode-specific permissions; the provider cannot elevate them. This supports read-only annotation callers without statically requesting upload permissions.
• Document caller examples, update/rollback guidance, and check-name compatibility.
• Add 13 dependency-free regression tests, read-only/SARIF lint fixtures, and a pinned CI workflow for contract tests and actionlint.

Rollout

This is the provider change for centralize-actions-security-scanning, separate from the Renovate work.

After this PR merges, follow-up PRs will pin its merged SHA:

• gitify-app/website, gitify-app/gnome, and gitify-app/gitify: replace duplicated zizmor workflows.
• gitify-app/kde: add missing scanning coverage.
• gitify-app/.github: add a separate pinned self-scan caller.

All five repositories are public and support SARIF reporting. Existing required checks do not reference the duplicated zizmor job name; no branch-protection settings are changed here. Reusable job names and analysis keys will be verified during rollout.

Validation

• node --test tests/zizmor-workflow.test.mjs: 13 passed.
• Actionlint 1.7.12 with ShellCheck 0.11.0: passed for new workflows and both caller fixtures.
• Offline zizmor 1.30.1: no unsuppressed findings in the new workflows/fixtures.
• Two fixture-only self-repository ignores are documented because the pinned actionlint does not support the newer $/ syntax. Production caller references will use full SHAs.
• git diff --check: passed.

Local tests evaluate the workflow's actual boolean expressions for push, same-repository PR, fork PR, disabled upload mode, and unavailable head metadata. They are not a substitute for live SARIF upload, caller-local config, and fork-PR checks; those remain rollout verification tasks.

The existing Renovate workflow and configs are unchanged. Its unrelated existing ShellCheck directive diagnostics were not folded into this change.