Context

We currently have the same zizmor workflow and config in all of our repos. We can centralize both into https://github.com/mongodb-labs/drivers-github-tools to maintain a single config file and only have dependabot updates in one place.

See https://github.com/Calysto/maintainer_tools/tree/main#zizmor for an example used in another open source project.

Definition of done

The new action is part of a drivers github tools release and is used by all of our repos, pinned to v1. Use the task tacking sheet for coordination.

Pitfalls

None