build

github: scope/narrow permissions, prevent template injection via GHA, enable zizmor workflow #17024

Job	Run time
build (ubuntu-latest)	5m 9s
build (macos-13)	10m 14s
build (macos-14)	3m 58s
Build jj-lib without Git support	51s
build (windows-latest)	10m 15s
build (ubuntu-latest, --all-features)	6m 27s
Check protos	26s
cargo-deny (advisories)	31s
cargo-deny (bans licenses sources)	25s
Clippy check	2m 39s
Check that MkDocs can build the docs	13s
Check that MkDocs can build the docs with latest Python and uv	28s
Check formatting	21s
	41m 57s

Provide feedback