ci: add zizmor workflow

[Sheraff]

Summary

• Add a pinned zizmor GitHub Actions security analysis workflow.
• Harden existing workflows for zizmor findings by disabling persisted checkout credentials, narrowing write permissions, and avoiding direct expression interpolation in shell scripts.

[pkg-pr-new]

More templates

• @tanstack/devtools-example-angular-a11y-devtools
• @tanstack/devtools-example-angular-basic
• @tanstack/devtools-example-angular-panel
• ssr
• @tanstack/devtools-example-angular-with-devtools
• @tanstack/devtools-example-preact-basic
• @tanstack/devtools-custom-devtools-preact
• @tanstack/react-devtools-a11y-example
• @tanstack/devtools-example-react-basic
• start-repro
• @tanstack/devtools-custom-devtools
• tanstack-start-example-counter
• @tanstack/devtools-example-react-https
• start
• @tanstack/devtools-example-react-time-travel
• @tanstack/solid-devtools-a11y-example
• @tanstack/devtools-example-solid-basic
• @tanstack/devtools-example-devtools-ui
• @tanstack/devtools-example-solid-start
• @tanstack/query-example-vue-basic

@tanstack/angular-devtools

npm i https://pkg.pr.new/@tanstack/angular-devtools@440

@tanstack/devtools

npm i https://pkg.pr.new/@tanstack/devtools@440

@tanstack/devtools-a11y

npm i https://pkg.pr.new/@tanstack/devtools-a11y@440

@tanstack/devtools-client

npm i https://pkg.pr.new/@tanstack/devtools-client@440

@tanstack/devtools-ui

npm i https://pkg.pr.new/@tanstack/devtools-ui@440

@tanstack/devtools-utils

npm i https://pkg.pr.new/@tanstack/devtools-utils@440

@tanstack/devtools-vite

npm i https://pkg.pr.new/@tanstack/devtools-vite@440

@tanstack/devtools-event-bus

npm i https://pkg.pr.new/@tanstack/devtools-event-bus@440

@tanstack/devtools-event-client

npm i https://pkg.pr.new/@tanstack/devtools-event-client@440

@tanstack/preact-devtools

npm i https://pkg.pr.new/@tanstack/preact-devtools@440

@tanstack/react-devtools

npm i https://pkg.pr.new/@tanstack/react-devtools@440

@tanstack/solid-devtools

npm i https://pkg.pr.new/@tanstack/solid-devtools@440

@tanstack/vue-devtools

npm i https://pkg.pr.new/@tanstack/vue-devtools@440

commit: ad78be6