ci: Add zizmor config file

This restores behavior of version 1.5.2 to be more lenient for
pypa and astral-sh repos.

Author: bdarnell

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # By default, actions/*, github/*, and dependabot/* are allowed to be ref-pinned,
+        # while the rest must be hash-pinned. Add pypa and astral-sh as trusted repos
+        # as well.
+        pypa/*: ref-pin
+        astral-sh/setup-uv: ref-pin