Check GitHub Action pins for impostor and mismatched commits in CI #47

The shared Renovate preset automerges digest updates without waiting for a minimum release age, and the auto-approve workflow approves them. If an upstream tag is moved to a malicious commit the change can merge without anyone looking at it. Asking a human to review every digest bump isn't realistic. These checks need to run automatically, as a check that has to pass before the PR can merge.

update-action-pins.yml already makes sure every action is pinned to a SHA. Nothing checks whether that SHA can be trusted.

Add a reusable workflow that runs zizmor over .github/ with a GitHub token, so its online audits run. The job fails only on these three audits:

• impostor-commit: the pinned SHA isn't on any branch or tag of the upstream repo, for example a commit from a fork served under the parent repo's URL.
• ref-version-mismatch: the version comment doesn't match the pinned SHA.
• known-vulnerable-actions: the pinned version has a published GitHub security advisory.

zizmor probably can't be told to run only some audits. So the job might need to filter the output to figure our if a relevant audit failed.

AC

• A reusable workflow fails on findings from impostor-commit, ref-version-mismatch or known-vulnerable-actions, and on no other zizmor findings. It runs on every PR in dev-kit too