workflows/actionlint: run zizmor

Port of Homebrew/homebrew-core#195961.

See https://github.com/woodruffw/zizmor.

.github/workflows/actionlint.yml

@@ -53,3 +53,31 @@ jobs:
           echo "::add-matcher::.github/actionlint-matcher.json"
 
       - run: actionlint
+
+  zizmor:
+    if: github.repository_owner == 'Homebrew'
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/homebrew/ubuntu22.04:master
+    steps:
+      - name: Set up Homebrew
+        id: setup-homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+        with:
+          core: true
+          cask: false
+          test-bot: false
+
+      - name: Install zizmor
+        run:  brew install zizmor
+
+      - name: Run zizmor
+        run: zizmor --format sarif "${HOMEBREW_TAP_REPOSITORY}" | tee results.sarif
+        env:
+          HOMEBREW_TAP_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor