feat(ci) - add zizmor to do static analysis on github actions

[gabrielseco]

After tanstack supply chain incident, we install zizmor to do static analysis on the github actions and prevent security incidents...

Whenever a github action changes, zizmor will run

Run the fix script to fix the errors and add some docs about the tool as you need to install it globally

---

Note

Low Risk
CI and workflow-only changes that reduce supply-chain and credential exposure; no application runtime or auth logic is modified.

Overview
Adds zizmor static analysis for GitHub Actions: a new workflow runs on PRs and main when .github/workflows/*.yml changes, and pnpm run lint:workflows / lint:workflows:fix are documented in CONTRIBUTING.md.

Hardens existing PR workflows (actions.yml, actions-v0.yml) with workflow-level contents: read, pinned action SHAs (checkout, setup-node, cache, pnpm), and persist-credentials: false on checkout. The main PR workflow drops the separate git submodule update --init step while keeping submodule checkout via actions/checkout.

^{Reviewed by Cursor Bugbot for commit 0073fe5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0d60c72. Configure here.}

[sandrina-p]

LGTM 👍 pipelines are passing, so hopefully we won't need to revert this