feat: add reusable zizmor scan workflow for consumer repos

[michaelpeterswa]

Publishes zizmor_scan.yml as a workflow_call reusable workflow so any
repo in the org can add zizmor scanning to its own CI with a single
uses: line, rather than everyone hand-rolling the setup we built in
#78/#79.

Defaults to audit-only (fail-on-findings: false) to match the rollout
approach used in this repo: annotate and comment, don't block, so
adopting repos aren't immediately red on day one. Reports via GitHub
annotations rather than SARIF, since most consumer repos are private
and don't have a GitHub Advanced Security license (see prior
discussion in #76). Exposes fail-on-findings, comment, persona, and
min-severity as inputs so each repo can tune it once they're ready.

Uses its own zizmor/{version} tag prefix in the README's versioning
scheme, since it isn't tied to a language stack the way go_app/php_lib
etc. are.

Test plan

• zizmor on this file (both regular and pedantic personas): 0 findings.
• actionlint: clean.
• The zizmor and PR summary comment checks (inherited from Add zizmor static analysis gate for GitHub Actions workflows #78) both pass on this PR.
• After merge, cut zizmor/v1 and zizmor/v1.0.0 tags per this repo's versioning convention, since consumer repos need a tag to pin to (not @main).
• Adopt in a pilot consumer repo to confirm the uses: call works cross-repo before announcing broadly.

Part of #76.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[github-actions]

🌈 zizmor findings

Found 96 finding(s) across the workflows in this PR.

Rule	Severity	Count
unpinned-uses	High	58
template-injection	High	10
artipacked	Medium	17
archived-uses	Medium	3
adhoc-packages	Low	7
template-injection	Low	1

See the zizmor job run for details, or the audit docs.