Apply zizmor and update scripts

.github/.cspell/project-dictionary.txt

@@ -24,6 +24,7 @@ pluginconf
 ppcle
 quickinstall
 rclone
+rdme
 rootfs
 sccache
 syft

.github/zizmor.yml

@@ -0,0 +1,16 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  dependabot-cooldown: { disable: true } # Useless unless unpinned-uses is enabled.
+  ref-confusion: { disable: true } # TODO: Old GHA didn't work without this pattern in some cases, but does it seem to be fixed?
+  secrets-inherit: { disable: true }
+  unpinned-uses:
+    config:
+      policies:
+        taiki-e/*: any
+        '*': ref-pin
+  obfuscation:
+    ignore:
+      # We use `shell: cmd` to test compatibility
+      - ci.yml