Use locked install for zizmor (#2350)

To be on the safe side when installing zizmor and it's dependencies
we're using a locked installation, meaning that the dependencies
and their versions are taken from the Cargo.lock file.

This will hopefully reduce the chances of having the pipeline
randomly fail due to updated dependencies down the line.

.github/workflows/zizmor.yaml

@@ -23,6 +23,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install zizmor
-        run: cargo install zizmor
+        run: cargo install --locked zizmor
       - name: Run zizmor
         run: zizmor .github/workflows