Add zizmor checks on CI. (#5161)

* Add zizmor checks on CI.

* Fix zizmor credentials warnings

* Add persist-credentials: false to action-cached-lfs-checkout too.

* Add empty permissions by default.

* Ignore pull_request_target failure and add a warning.

.github/workflows/blocked.yml

@@ -1,7 +1,13 @@
 name: Prevent blocked
+
 on:
-  pull_request_target:
+  # Privilege escalation necessary to access PR context and set status checks
+  # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, labeled, unlabeled, synchronize]
+
+permissions: {}
+
 jobs:
   prevent-blocked:
     name: Prevent blocked
@@ -10,7 +16,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Add notice
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         if: contains(github.event.pull_request.labels.*.name, 'X-Blocked')
         with:
           script: |