ci: tighten zizmor actions hardening

[djchen]

Summary

• expand zizmor coverage to all of .github and fail on low+ findings
• deny default workflow token permissions and scope contents:read to checkout jobs
• add zizmor allowed-action policy, CI concurrency, and Dependabot cooldowns that satisfy zizmor

Verification

• docker run --rm -v "/home/djchen/Workspace/opencode-web-docker:/workspace:ro" -w /workspace ghcr.io/zizmorcore/zizmor:latest --persona=regular --min-severity=low --min-confidence=medium .github
• docker run --rm -v "/home/djchen/Workspace/opencode-web-docker:/repo:ro" -w /repo rhysd/actionlint:latest
• git diff --check