Improved existing setup for zizmorchecks

[Sandijigs]

I kept the audit behavior the same as #1037 still pedantic persona, still
min-severity: low, still pointed at .github/workflows. The main difference
is that the install step is gone and the action now uploads its findings as
SARIF, so they show up in the Security tab instead of only in the workflow logs.

For that SARIF upload to work the job needs security-events: write,
contents: read, and actions: read, so I added those at the job level
and tightened the workflow-level permissions to {} while I was there.

The action is pinned by commit SHA (v0.5.6) to keep zizmor's own
unpinned-uses rule happy, same convention as #1037.

Closes #1061.

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @Mark-Simulacrum (or someone else) some time within the next two weeks.

Why was this reviewer chosen?

The reviewer was selected based on:

• Fallback group: @Mark-Simulacrum, internal-sites
• @Mark-Simulacrum, internal-sites expanded to Mark-Simulacrum, Urgau, ehuss, jieyouxu
• Random selection from Mark-Simulacrum, Urgau, ehuss, jieyouxu

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[rustbot]

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

[ubiratansoares]

@Sandijigs Added some comments

View changes since this review

[ubiratansoares]

If I got this input correctly, it acts like a filter for findings. Most likely we don't want to have any filters

[ubiratansoares]

We should also opt-out from Github Advance Security, since we want to fail the CI in case there are any zizmor findings, at least for now

[ubiratansoares]

Since the default path for inputs collection is ., we can remove this one