CI(zizmor): Add per-repo zizmor security audit workflow

.github/dependabot.yml

@@ -4,14 +4,14 @@
 
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
     commit-message:
       prefix: "Chore"
     open-pull-requests-limit: 15
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"
@@ -20,3 +20,14 @@
     open-pull-requests-limit: 15
     exclude-paths:
       - "LICENSES/**"
+  # Pip entry exists solely to keep the zizmor pin in
+  # .github/dependabot/zizmor-requirements.txt up to date; that
+  # file is consumed at run-time by .github/workflows/zizmor.yaml
+  # via grep, never installed via pip.
+  - package-ecosystem: "pip"
+    directory: "/.github/dependabot"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "Chore"
+    open-pull-requests-limit: 5

.github/dependabot/zizmor-requirements.txt

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+#
+# Pin for the zizmor static analyser used by
+# .github/workflows/zizmor.yaml.
+#
+# This file exists solely so Dependabot can keep the zizmor version
+# current via its pip ecosystem (see ../dependabot.yml). The
+# workflow reads the pin from this file at run-time with grep; it
+# is never installed by pip itself.
+#
+# Edit format: a single line of `zizmor==<version>`. Do not add
+# other packages here.
+zizmor==1.24.1