Add shared zizmor workflow

[opentelemetrybot]

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, release/*, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

Zizmor remediation

This change also resolves findings from these zizmor rules:

• artipacked
• cache-poisoning
• dangerous-triggers
• github-app
• template-injection

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[opentelemetry-pr-dashboard]

This PR has review comments. Review suggestions, whether from maintainers or automated reviewers, aren't always correct or required. Please evaluate each comment on its merits, then make sure each thread has a clear outcome.

For example, link to the commit if you applied a suggestion, explain why it wasn't applied, or ask a follow-up question.

Automation flags a PR for human review once every review thread has a reply or is marked as resolved.

Status across open PRs is visible on the pull request dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.61%. Comparing base (2724fc6) to head (6945ec2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8592   +/-   ##
=========================================
  Coverage     91.61%   91.61%           
  Complexity    10311    10311           
=========================================
  Files          1013     1013           
  Lines         27260    27260           
  Branches       3201     3201           
=========================================
  Hits          24975    24975           
  Misses         1560     1560           
  Partials        725      725           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.