ci: add shared security scanning workflow

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a shared, SHA-pinned Zizmor security scanning workflow and hardens GitHub Actions security practices.

Changes:

• Adds scheduled, PR, push, and manual Zizmor scanning with SARIF upload.
• Disables persisted checkout credentials across workflows.
• Hardens shell handling and adds Dependabot cooldowns.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Summary
.github/workflows/zizmor.yml	Adds shared Zizmor scanning.
.github/workflows/iwyu.yml	Disables checkout credential persistence.
.github/workflows/fossa.yml	Disables checkout credential persistence.
.github/workflows/doxygen-tidy.yaml	Disables checkout credential persistence.
.github/workflows/dependencies_image.yml	Disables checkout credential persistence.
.github/workflows/cppcheck.yml	Disables checkout credential persistence.
.github/workflows/codeql-analysis.yml	Disables checkout credential persistence.
.github/workflows/cmake_install.yml	Disables checkout credential persistence.
.github/workflows/clang-tidy.yaml	Hardens environment variable handling.
.github/workflows/ci.yml	Disables checkout credentials and updates DocFX shell handling.
.github/workflows/benchmark.yml	Disables checkout credential persistence.
.github/dependabot.yml	Adds seven-day update cooldowns.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.63%. Comparing base (68a575f) to head (3d978cd).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4465      +/-   ##
==========================================
+ Coverage   82.62%   82.63%   +0.01%     
==========================================
  Files         512      512              
  Lines       20139    20139              
==========================================
+ Hits        16638    16640       +2     
+ Misses       3501     3499       -2     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.