Run zizmor in CI, and fix most warnings #36967

Job	Run time
cargo build (release)	0s
cargo fmt	17s
Determine changes	10s
pre-commit	1m 29s
mkdocs	2m 41s
python package	1m 26s
benchmarks	4m 37s
cargo build (msrv)	3m 54s
cargo fuzz build	0s
cargo clippy	1m 47s
cargo shear	22s
cargo test (linux)	1m 44s
cargo test (linux, release)	3m 53s
cargo test (wasm)	1m 29s
cargo test (windows)	3m 53s
formatter instabilities and black similarity	3m 13s
test scripts	1m 4s
fuzz parser	6m 10s
test ruff-lsp	34s
ecosystem	3m 59s
	42m 42s

Provide feedback