ci: add zizmor workflow