build

github: scope/narrow permissions, prevent template injection via GHA, enable zizmor workflow #17372

Job	Run time
Build jj-lib without Git support	52s
build (ubuntu-latest)	5m 6s
build (macos-13)	7m 41s
build (macos-14)	3m 51s
Check protos	50s
build (windows-latest)	9m 2s
build (ubuntu-latest, --all-features)	6m 2s
Check that MkDocs can build the docs	10s
Check that MkDocs can build the docs with latest Python and uv	14s
Check formatting	18s
cargo-deny (advisories)	27s
cargo-deny (bans licenses sources)	26s
Clippy check	2m 41s
	37m 40s

Provide feedback