Add zizmor GitHub Actions security workflow

[bchassoul]

zizmor found a few existing workflow security issues:

  - ruleId: zizmor/artipacked
    kind: fail
    level: warning
    message: credential persistence through GitHub Actions artifacts
    locations:
      .github/workflows/main.yml
  - ruleId: zizmor/excessive-permissions
    kind: fail
    level: warning
    message: overly broad permissions
    locations:
      .github/workflows/main.yml
  - ruleId: zizmor/unpinned-uses
    kind: fail
    level: error
    message: unpinned action reference
    locations:
      .github/workflows/main.yml
      .github/workflows/publish.yml
      .github/workflows/shelltests.yml
  - ruleId: zizmor/archived-uses
    kind: fail
    level: warning
    message: action or reusable workflow from archived repository
    locations:
      .github/workflows/publish.yml

Not sure why the test passes, see log here

[GwendalLaurent]

Not sure why the test passes
According to ChatGPT, that's because the vulnerabilities were already present in the code before the PR.

In my opinion, even if the CI is green, it's probably a good idea to fix the vulnerabilities in this PR

[maehjam]

PR should be to kickstarter/base not main.