ci: add zizmor workflow

[Sheraff]

Summary

• Add a pinned zizmor GitHub Actions security analysis workflow.
• Harden existing workflows by pinning external actions, disabling checkout credential persistence, and scoping write permissions to the release job.
• Move dynamic GitHub expressions out of shell commands and use an explicit token-authenticated release push URL.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@tanstack/intent@134

commit: e7d78d9