Add a zizmor workflow audit and harden the check workflow - #2

No file matched to [/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/*requirements*.txt,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/*requirements*.in,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/*constraints*.txt,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/*constraints*.in,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/pyproject.toml,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/uv.lock,/home/runner/work/gradle-dependencychecks-plugin/gradle-dependencychecks-plugin/**/*.py.lock]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.