ci: add security analysis workflow

[Boshen]

Summary

• add the canonical Security Analysis workflow using oxc-project/security-action
• replace legacy zizmor workflow files where present

Testing

• Not run; workflow-only change.

[codspeed-hq]

Merging this PR will not alter performance

✅ 12 untouched benchmarks

---

_{Comparing codex/add-security-analysis-workflow (1242ee4) with main (4adc51f)}