Make zizmor.yml a reusable workflow_call workflow

[dduugg]

Summary

zizmor.yml becomes a workflow_call workflow, so gem repos can call zizmor from here instead of each keeping its own copy. This follows what #29 did for codeql.yml.

• zizmor-self-scan.yml keeps the push and PR triggers and calls $/.github/workflows/zizmor.yml, GitHub's self-repository syntax. shared-config still scans itself and uploads to the Security tab as before. $/ resolves to the commit that is running, so a PR that edits zizmor.yml is tested against its own version. codeql-self-scan.yml switches from ./ to $/ too: zizmor 1.30's self-repository audit flags ./, and the v0.6.4 bump below would otherwise add that alert on main.
• advanced-security input (boolean, default true, zizmor-action's default):
  • true uploads the results to the Security tab, as the current workflow does.
  • false reports findings as annotations and fails the job.
  • A required check needs false, because zizmor exits 0 whenever it writes SARIF. I checked locally: zizmor 1.30.0 on a workflow with findings exits 0 with --format sarif and 14 with --format github.
• No permissions block on the job. The two modes need different permissions, and a reusable workflow's job can't ask for more than its caller grants, so it takes the caller's. The README lists what each mode needs. ci.yml and cd.yml do the same.
• The README moves zizmor into the reusable-workflows table and adds a caller example. It names the check to require (zizmor / zizmor with the example) and notes that callers tracking @main pick up zizmor-action upgrades, and any new audits, at once.
• CodeQL docs. Make codeql.yml a reusable workflow_call workflow #29 never added codeql.yml or codeql-self-scan.yml to the README. Both are now in the tables, with a caller example and the languages input.
• zizmor-action goes to v0.6.4 (zizmor 1.30.1). v0.6.2 still ran 1.29.0, and rubyfmt-action is already on v0.6.3, so moving it onto this workflow would otherwise have been a downgrade. action.sh is the same in both versions.

The first caller will be rubyatscale/singed, which will use advanced-security: false so zizmor can be a required check there.

Test plan

• actionlint is clean apart from the two $/ calls, which actionlint 1.7.12 doesn't recognize yet (Support the new $/ self-repository uses: syntax rhysd/actionlint#711).
• zizmor (regular persona) reports no findings.
• Both self-scans run on this PR through $/, and the zizmor scan uploads to code scanning. The self-repository alerts (#44, #45) show as fixed.