new feature: use zizmor to static analysis the GitHub Actions files and fix them

[yihong0618]

Feature Description

zizmor: https://woodruffw.github.io/zizmor/

As more and more attackers using GitHub Actions to steal the token or attack other users such as Mining Scripts
more can check issue one-api or https://www.praetorian.com/blog/compromising-bytedances-rspack-github-actions-vulnerabilities/
we can use static check to avoid them as we can.

Problem and Solution

using zizmor to fix all

Additional Context

No response

Are you willing to contribute to the development of this feature?

• Yes, I am willing to contribute to the development of this feature.