Add pinact and zizmor workflow checks

[demeyerthom]

This PR adds two GitHub Actions workflow checks:

• pinact: Ensures all GitHub Actions are pinned to commit SHAs for supply chain security
• zizmor: Scans workflows for security issues

All existing actions have been pinned to their commit SHAs as part of this PR.