Perf: Only sync zizmor versions that don't already exist in the versions file

[woodruffw]

This is pretty minor, but it would save us a few seconds of CI time.

TL;DR: right now we fetch the hash for every zizmorcore/zizmor tag on ghcr.io, but that's redundant for every version we already have a hash for (in support/versions). We should probably load that file and use it to skip versions we already have pinned (with the exception of latest, since that one is expected to always change).