[adoroszlai]

What changes were proposed in this pull request?

The GitHub Actions Policy requires a specific git hash only for external actions; actions in the apache/*, github/* and actions/* namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still MUST be pinned to a specific git hash. (source)

• This PR updates workflows to pin actions/* and apache/* by major version instead of SHA, as recommended by Apache Infra above. github/* actions are not used here.
• Configure zizmor to allow such pinning.
• Make sure zizmor workflow is triggered by changes in zizmor config.

https://issues.apache.org/jira/browse/RATIS-2756

How was this patch tested?

Verified that external actions are still pinned by SHA:

$ rg 'uses: ' .github/workflows | grep -v 'uses: \(actions\|apache\|$/\)'
.github/workflows/zizmor.yaml:      uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4

And that no first-party actions use SHA:

$ rg 'uses: (actions|apache)' .github/workflows | grep -c '# v'
0

CI: https://github.com/adoroszlai/ratis/actions/runs/39737007311
allowlist-check: https://github.com/adoroszlai/ratis/actions/runs/39737007348
zizmor: https://github.com/adoroszlai/ratis/actions/runs/39737007392

[szetszwo]

+1 the change looks good.

[adoroszlai]

Thanks @szetszwo for the review.