security: Run zizmor on CI, resolve actions

[andrewpollack]

zizmor runs static analysis on GitHub actions with proposed remediation steps. I ran on the TWiR repo, and attached remediations for each:

• https://docs.zizmor.sh/audits/#artipacked actions/checkout will by default persist git configuration for the duration of the workflow, which is not necessary in this case.
• https://docs.zizmor.sh/audits/#excessive-permissions detects excessive permissions in workflows, both at the workflow level and individual job levels.
• https://docs.zizmor.sh/audits/#unpinned-uses Tag- or branch-pinned actions can be changed by the upstream repository, either by force-pushing over the tag or updating the branch.

[nellshamrell]

Thank you so much @andrewpollack!