feat: harden workflow validation and permissions

[hriszc]

Fixes #388

This expands the workflow-validation path instead of only patching a few individual workflows:

• add a unified workflow security job on top of the existing schema check
• run actionlint and zizmor in CI for workflow changes
• add explicit least-privilege permissions to the highest-risk pull_request_target and issue_comment workflows
• keep the scope small enough to review independently from the broader workflow cleanup already in progress

Validated locally by parsing all workflow YAML files after the changes.

[github-actions]

Welcome to AsyncAPI. Thanks a lot for creating your first pull request. Please check out our contributors guide useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.