Add zizmor

[martincostello]

Scan GitHub Actions workflows with zizmor and fix/suppress findings.

[Copilot]

Pull Request Overview

This PR integrates zizmor, a security linter for GitHub Actions workflows, and addresses security findings by pinning action versions to specific commit hashes and adding security configurations. The changes enhance workflow security by implementing commit hash pinning, adding proper checkout configurations, and introducing comprehensive workflow security scanning.

Key changes:

• Added zizmor security scanning to the lint workflow
• Pinned all GitHub Actions to specific commit hashes for security
• Enhanced checkout configurations with security-focused options

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/lint.yml	Added zizmor security scanning, pinned action versions, and enhanced checkout security
.github/workflows/codeql.yml	Pinned CodeQL actions to commit hashes and secured checkout configuration
.github/workflows/build.yml	Pinned setup actions and improved package version management for Spectral CLI
.github/workflows/benchmark.yml	Pinned all actions to commit hashes and secured checkout steps

Comments suppressed due to low confidence (1)

.github/workflows/build.yml:49

• Version v4.6.2 of actions/upload-artifact may not exist. My knowledge cutoff is January 2025, and this appears to be a future version. Please verify this version and commit hash are correct.

        show-progress: false

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.