Integrate zizmor linting?

https://github.com/woodruffw/zizmor is a static analyzer for GH workflows.
I am considering integrating it here, however:
* it's then another workflow that is practically part of tuf-on-ci: I don't want to just keep adding things...
* it's still beta

I have ran zizmore locally and results are green... so maybe let's reconsider in 2025