Add zizmor security scanning for GitHub Actions workflows

[dduugg]

Summary

• Add zizmor-action to scan this repo's own GitHub Actions workflows for security issues, on every push to main and every PR. Uses GitHub Advanced Security (SARIF upload to the Security tab), which is free for public repos.
• Resolve the two findings zizmor surfaced when run locally against the current workflows:
  • dependabot-cooldown: .github/dependabot.yml was missing a cooldown window — added cooldown.default-days: 7.
  • template-injection: ci.yml's "Assert the action failed" step interpolated ${{ steps.rubyfmt.outcome }} directly into a run: shell block. Moved it into an env: var (ACTUAL_OUTCOME) instead, matching the pattern action.sh already uses elsewhere in this repo.

Test plan

• zizmor --persona=regular . reports no findings locally after the fixes.
• actionlint passes locally.
• CI (including the new zizmor job) passes on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.