feat: zizmor

[peytondmurray]

This PR adds support for zizmor, a static analysis tool for GitHub Actions.

There have been a number of supply chain attacks recently that have me thinking about security, and some colleagues have recommended zizmor for catching some of the more common things (like pinning action versions). I saw that it has an experimental LSP mode, so I've added it here.

This is basically a copy of what is already in https://github.com/neovim/nvim-lspconfig/blob/master/lsp/gh_actions_ls.lua, except the docs and cmd have been updated to refer to zizmor rather than the github actions language server. That means that only github actions files are targeted, using the same machinery as gh_actions_ls already uses. For clarity, github actions LS provides completion, definitions, etc for github actions files while zizmor focuses on security-related concerns, so they cover different use cases.

Right now, the project has 4.1k stars and is very active, so it meets the criteria for being added as a supported language server here, but I will note that zizmor's LSP mode is experimental. There's a meta-issue tracking LSP work here for anyone interested.