ci: pin every workflow action to a full commit sha; nightly zizmor lint (LAB) #6111

Rebuild of stale PR #5560 on current main. Every third-party action in .github/workflows is pinned to a full commit sha (version in a trailing comment); the org reusable gate stays @main. Adds zizmor-nightly.yml (schedule + dispatch only, LAB) and .github/zizmor.yml.