👷(ci) add Menshen scan for GitHub Actions vulnerabilities

Wire Menshen into the CI to scan the GitHub Actions we use and flag
vulnerable ones, following the same approach as other projects that
recently adopted it.

Note: I am not fully sure about the current setup. Reviewers should
feel free to adjust the configuration or the integration point as
they see fit.

.github/workflows/security.yml

@@ -0,0 +1,21 @@
+name: Security analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - "**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@main
+    with:
+      config: .github/zizmor.yml