HDDS-16816. Pin first-party actions to a major version tag

[adoroszlai]

What changes were proposed in this pull request?

The GitHub Actions Policy requires a specific git hash only for external actions; actions in the apache/*, github/* and actions/* namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still MUST be pinned to a specific git hash. (source)

• This PR updates workflows to pin actions/* and apache/* by major version instead of SHA, as recommended by Apache Infra above. github/* actions are not used here.
• Configure zizmor to allow such pinning.
• Make sure zizmor workflow is triggered by changes in zizmor config.

https://issues.apache.org/jira/browse/HDDS-16816

How was this patch tested?

CI: https://github.com/adoroszlai/ozone/actions/runs/37925275778
zizmor: https://github.com/adoroszlai/ozone/actions/runs/38028809392
asf-allowlist-check: https://github.com/adoroszlai/ozone/actions/runs/38028771269

[adoroszlai]

Test failure in integration (container) is not relevant.

[smengcl]

+1. Thanks @adoroszlai