Supply chain/CI security: Run zizmor over the core repositories

[kmannislands]

To harden out GHA, we should run Zizmor over all of the config for at least this repo, earthbuild/buildkitd and the earthbuild/actions-setup