chore: add shared security scanning workflow

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.59%. Comparing base (4cc1e9b) to head (dd45f8c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1028   +/-   ##
=======================================
  Coverage   17.59%   17.59%           
=======================================
  Files          24       24           
  Lines         722      722           
=======================================
  Hits          127      127           
  Misses        595      595           

Flag	Coverage Δ
api	17.59% <ø> (ø)
elixir	17.59% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR introduces a new GitHub Actions workflow to run Zizmor via the OpenTelemetry shared workflow and makes small hardening/cleanup updates across existing CI workflows (disabling persisted checkout credentials and simplifying some cache key hashing).

Changes:

• Add a new .github/workflows/zizmor.yml workflow that runs on PRs, pushes to main, and a weekly schedule, uploading results to code scanning via the shared reusable workflow.
• Update multiple workflows to set actions/checkout persist-credentials: false.
• Simplify hashFiles(...) usage in some cache keys.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Adds Zizmor scanning using the OpenTelemetry shared reusable workflow pinned to an immutable commit.
.github/workflows/w3c_interop.yml	Hardens checkout credentials and tweaks cache key hashing (also reveals an invalid matrix.* reference in cache key usage).
.github/workflows/fossa.yml	Hardens checkout by disabling persisted credentials.
.github/workflows/erlang.yml	Hardens checkout credentials and simplifies cache key hashing.
.github/workflows/elixir.yml	Hardens checkout by disabling persisted credentials across multiple jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/w3c_interop.yml:34

• actions/cache cache key and restore key reference ${{ matrix.otp_version }}, but this job does not define a strategy.matrix, so matrix will be undefined at runtime and the workflow will fail expression evaluation. Use a literal OTP version (since setup-beam is pinned to 26.1.2 here) or introduce a matrix/env var and reference that instead.

        path: |
          _build
        key: ${{ runner.os }}-build-${{ matrix.otp_version }}-${{ hashFiles('rebar.lock') }}-1
        restore-keys: |
          ${{ runner.os }}-build-${{ matrix.otp_version }}-1-