ci: add reusable Security Scan workflow (zizmor), pin actions to SHAs

[crowecawcaw]

Mirrors the aws-deadline/.github zizmor setup for the OpenJobDescription org.

What this adds

• .github/workflows/reusable_security_scan.yml — a central, extensible security-scan umbrella workflow that member repos call from a thin stub. zizmor (GitHub Actions static analysis) is the first check; future checks are added here as sibling jobs so repos never need re-editing. Gated on high-severity findings (min-severity: high); findings report to the run log and PR annotations rather than the Security tab.
• .github/workflows/security_scan.yml — a self-caller so this repo scans itself on push and PR to mainline (and weekly), modeled on the existing CodeQL caller. Other OpenJobDescription repos add an equivalent stub:

  jobs:
    security-scan:
      uses: OpenJobDescription/.github/.github/workflows/reusable_security_scan.yml@mainline

• zizmor.yml — a single central config with an unpinned-uses policy (OpenJobDescription/* → ref-pin, everything else → hash-pin), consumed by the reusable workflow via --config. One edit here updates policy for every consuming repo.
• .github/dependabot.yml — keeps the SHA pins current.

Prep required to make the gate green

• Pinned all third-party GitHub Actions to full commit SHAs with version comments across every reusable workflow and composite action. Our own OpenJobDescription/* reusable workflows keep their @mainline refs on purpose (allowed by the ref-pin policy).
• Fixed all 19 high-severity template-injection findings by routing ${{ }} expansions through env: vars referenced as shell variables.

Verified locally with zizmor --config zizmor.yml --min-severity high .github/ → No findings to report (exit 0).

Draft

Leaving as a draft for review before publishing.