Adopt shared zizmor workflow

[opentelemetrybot]

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow uploads zizmor results to GitHub code scanning. After this PR merges, maintainers should:

1. Open the merged commit's Actions checks and confirm the Zizmor workflow succeeded on the default branch.
2. Open Security > Code scanning in this repository and confirm zizmor analyzed the merged commit.
3. Confirm the analysis has no high or critical security findings and no error-level findings.
4. Mark the corresponding admin PR ready for review, approve and merge it. After it merges, the repository ruleset requires a current zizmor analysis and blocks findings at those thresholds.
5. On the next repository PR, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin. Keep the zizmor workflow enabled so findings remain visible.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Migrates zizmor scanning in this repository to use the OpenTelemetry shared reusable workflow, while adjusting GitHub App token permissions and suppressing a non-blocking zizmor warning in CodeQL workflow configuration.

Changes:

• Add a new zizmor.yml workflow that calls the OpenTelemetry shared zizmor reusable workflow pinned to a specific commit.
• Tighten/explicitly declare GitHub App token permissions for workflows that create pull requests (and push changes).
• Add a zizmor suppression for the CodeQL Gradle setup step (cache-poisoning rule).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Adds the zizmor workflow that delegates scanning to the shared OpenTelemetry reusable workflow with minimal permissions.
.github/workflows/release.yml	Adds explicit permission-pull-requests: write for the GitHub App token used to create PRs.
.github/workflows/prepare-release-branch.yml	Adds explicit permission-pull-requests: write for GitHub App tokens used to create PRs.
.github/workflows/codeql.yml	Adds a comment and a zizmor ignore annotation for the Gradle setup step.
.github/workflows/auto-update-semconv.yml	Adds explicit permission-contents: write and permission-pull-requests: write for the GitHub App token used to push and open PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.