Pass .zizmor.yml config to zizmor-action

Without this, the action runs with default settings and reports
unpinned-uses findings that we've intentionally disabled.

Author: dduugg

.github/dependabot.yml

@@ -4,3 +4,5 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7

.github/workflows/zizmor.yml

@@ -23,3 +23,5 @@ jobs:
 
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@v0.5.3
+        with:
+          config: .zizmor.yml