Integrate zizmor into CI

[ErichDonGubler]

Zizmor is a neat security tool that focuses on how repositories use GitHub Actions. Mozilla is starting to add it to its standard kit of GitHub Actions for its GH repos (albeit with a different entry point), and I decided to try out integrating it here. It seems workable enough to just fix things up and add it.

[ErichDonGubler]

Woot, existing checks are green! Now, I just need to add the check, and then this would be ready to merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[andyleiserson]

The provenance of the two Mesa installers is actually different, "which we control" doesn't apply to this one. (I noticed this while looking at install-mesa for unrelated reasons and came here because I was curious if zizmor flagged it.)