✨ Add zizmor to permissions allowlist

[martincostello]

What kind of change does this PR introduce?

Add zizmorcore/zizmor-action as an action that does not trigger a warning for use of security-events: write.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Using the action generates a finding similar to the below:

score is 0: jobLevel 'security-events' permission set to 'write'
Remediation tip: Visit [https://app.stepsecurity.io/secureworkflow](https://app.stepsecurity.io/secureworkflow/github.com/martincostello/update-dotnet-sdk/build.yml/main?enable=permissions).
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

What is the new behavior (if this is a feature change)?**

No finding is generated for use of security-events: write in a job that uses zizmorcore/zizmor-action.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

None.

Does this PR introduce a user-facing change?

Add `zizmorcore/zizmor-action` to allow-list for use of `security-events: write`.

[Copilot]

Pull Request Overview

This PR adds zizmorcore/zizmor-action to the allowlist of GitHub Actions that are permitted to use security-events: write permission without triggering a security warning. The action performs code scanning and uploads SARIF files to GitHub, which legitimately requires this permission.

• Adds zizmorcore/zizmor-action to the allowlist in the permissions checker
• Includes test case to verify the action is properly allowed
• Follows the same pattern as existing security scanning tools like hlint-scan

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
checks/raw/permissions.go	Adds zizmor-action to the allowlist of actions permitted to use security-events write permission
checks/testdata/.github/workflows/github-workflow-permissions-secevent-known-actions.yaml	Adds test case for zizmor-action to verify it doesn't trigger security warnings

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.30%. Comparing base (353ed60) to head (e990802).
⚠️ Report is 216 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4758      +/-   ##
==========================================
+ Coverage   66.80%   68.30%   +1.49%     
==========================================
  Files         230      249      +19     
  Lines       16602    18929    +2327     
==========================================
+ Hits        11091    12929    +1838     
- Misses       4808     5137     +329     
- Partials      703      863     +160     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

This pull request has been marked stale because it has been open for 10 days with no activity

[martincostello]

Awaiting review.