HDDS-16816. Pin first-party actions to a major version tag

[adoroszlai]

What changes were proposed in this pull request?

The GitHub Actions Policy requires a specific git hash only for external actions; actions in the apache/*, github/* and actions/* namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still MUST be pinned to a specific git hash. (source)

• This PR updates workflows to pin actions/* and apache/* by major version instead of SHA, as recommended by Apache Infra above. github/* actions are not used here.
• Configure zizmor to allow such pinning.
• Make sure zizmor workflow is triggered by changes in zizmor config.

https://issues.apache.org/jira/browse/HDDS-16816

How was this patch tested?

CI: https://github.com/adoroszlai/ozone-docker/actions/runs/38909025981
zizmor: https://github.com/adoroszlai/ozone-docker/actions/runs/38909026262
asf-allowlist-check: https://github.com/adoroszlai/ozone-docker/actions/runs/38909026075

[smengcl]

Thanks @adoroszlai for working on this.

[adoroszlai]

Thanks @smengcl for the review.