ci: add zizmor configuration for unpinned-uses

We could configure dependabot to pin shared workflow commit SHA hashes,
but for now, let's relax the unpinned-uses relax

Author: gotmax23

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "wntrblm/nox": ref-pin
+        "re-actors/alls-green": ref-pin
+        "actions/*": ref-pin