ci: add zizmor workflow linting

[omribz156]

Summary:

• Add zizmor to the workflow lint CI.
• Fix the workflow findings reported by zizmor, including token persistence, excessive permissions, setup-go caching, and template-injection warnings.

Verification:

• uvx zizmor .github/workflows
• C:\Users\omrib\go\bin\actionlint.exe -ignore 'not assignable' -ignore 'property "hack" is not defined'
• git diff --check

Note: raw actionlint reports the same existing baseline findings on clean origin/main and this branch. With those baseline findings ignored, this branch does not add new actionlint findings.

This was implemented with Codex assistance, with the final diff reviewed before posting.