ci: zizmor workflow