ci: add security analysis workflow

[Boshen]

Summary

• add the canonical Security Analysis workflow using oxc-project/security-action
• replace legacy zizmor workflow files where present

Testing

• Not run; workflow-only change.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32bf046a51

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass GitHub token into security-action

This workflow switched from an inline zizmor step (which exported GH_TOKEN) to oxc-project/security-action, but the pinned action runs zizmor without setting GH_TOKEN/GITHUB_TOKEN; as a result, scans run in offline mode and skip API-backed audits, so some workflow issues can be missed while the job still appears green. Please pass ${{ github.token }} to this step (and keep the needed read permissions) so the new workflow preserves the same audit coverage as the previous one.

Useful? React with 👍 / 👎.