ci: set Zizmor as required test

This adds Zizmor GHA security scanning as a PR gate.

Note that this does NOT require that Zizmor returns 0 alerts, but rather
that Zizmor's invocation completes successfully (regardless of how many
alerts it raises).

I will set up the former after this commit is merged (through the GH UI).

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>

tools/testing/gatekeeper/required-tests.yaml

@@ -6,7 +6,7 @@ required_tests:
   - Shellcheck required / shellcheck-required
   # TODO: cargo-deny-runner.yaml not yet treated as conditional
   - Cargo Crates Check Runner / cargo-deny-runner
-
+  - GHA security analysis / zizmor
 
 required_regexps:
   # Always required regexps