Add zizmor checks on CI. (#5161)

* Add zizmor checks on CI.

* Fix zizmor credentials warnings

* Add persist-credentials: false to action-cached-lfs-checkout too.

* Add empty permissions by default.

* Ignore pull_request_target failure and add a warning.

.github/workflows/unit_tests.yml

@@ -8,6 +8,8 @@ on:
   
   pull_request:
 
+permissions: {}
+
 jobs:
   tests:
     name: Tests
@@ -21,6 +23,8 @@ jobs:
 
     steps:
       - uses: nschloe/action-cached-lfs-checkout@f46300cd8952454b9f0a21a3d133d4bd5684cfc2 #v1.2.3
+        with:
+          persist-credentials: false
 
       - name: Setup environment
         run: source ci_scripts/ci_common.sh && setup_github_actions_environment
@@ -29,7 +33,7 @@ jobs:
         run: swift run -q tools ci unit-tests
 
       - name: Archive artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         # We only care about artefacts if the tests fail
         if: failure()
         with: