ci: add zizmor workflow

[Sheraff]

Summary

• Add a pinned zizmor workflow for GitHub Actions security analysis.
• Harden existing workflows by pinning actions, disabling checkout credential persistence, and scoping write permissions to jobs.

[pkg-pr-new]

@tanstack/angular-store

npm i https://pkg.pr.new/@tanstack/angular-store@326

@tanstack/lit-store

npm i https://pkg.pr.new/@tanstack/lit-store@326

@tanstack/preact-store

npm i https://pkg.pr.new/@tanstack/preact-store@326

@tanstack/react-store

npm i https://pkg.pr.new/@tanstack/react-store@326

@tanstack/solid-store

npm i https://pkg.pr.new/@tanstack/solid-store@326

@tanstack/store

npm i https://pkg.pr.new/@tanstack/store@326

@tanstack/svelte-store

npm i https://pkg.pr.new/@tanstack/svelte-store@326

@tanstack/vue-store

npm i https://pkg.pr.new/@tanstack/vue-store@326

commit: 982df54