Add zizmor workflow (#617)

* Add `zizmor` workflow

* fix issues

* fix one thing

* add permission comments

* add job names

* move zizmor to CI

.github/actions/ci-setup/action.yml

@@ -1,6 +1,12 @@
 name: Setup CI
 description: Setup CI
 
+inputs:
+  skip-cache:
+    description: "Whether to skip the cache"
+    required: false
+    default: "false"
+
 runs:
   using: composite
   steps:
@@ -10,7 +16,8 @@ runs:
     - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version-file: ".node-version"
-        cache: pnpm
+        package-manager-cache: ${{ inputs.skip-cache != 'true' }}
+        cache: ${{ inputs.skip-cache != 'true' && 'pnpm' || '' }}
 
     - name: Install dependencies
       shell: bash