Pass .zizmor.yml config to zizmor-action

Without this, the action runs with default settings and reports
unpinned-uses findings that we've intentionally disabled.

Author: dduugg

.github/workflows/zizmor.yml

@@ -23,3 +23,5 @@ jobs:
 
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@v0.5.3
+        with:
+          config: .zizmor.yml