[Denis-Averin]

Summary

Part of the zizmor rollout across all Aspose.BarCode Cloud repositories (Phase 2 of doc/zizmor-rollout-plan.md in the codegen repository).

• New zizmor.yml workflow: runs zizmor (static analysis for GitHub Actions) on push, pull_request and weekly. The job fails on any finding.
• Shared .github/zizmor.yml config, copied from the codegen templates (codegen/github/).
• python-package.yml, python-latest.yml, twine-check.yml, check-badges.yml: explicit permissions: contents: read, persist-credentials: false on every checkout, job names, concurrency group.
• publish-pypi.yml: permissions: {} at the workflow level; the job keeps id-token: write (OIDC) plus contents: read; cache: pip removed so the release never reads the Actions cache (cache poisoning guard).
• python-latest.yml: the "Keep only major.minor" step reads the previous step's output from $VERSIONS (set via env:) instead of expanding ${{ steps.… }} inside the script.
• pypa/gh-action-pypi-publish pinned to the commit of v1.14.3 (was the moving release/v1 branch) and snok/latest-python-versions to v1.1.2.
• README: zizmor badge (the codegen README template gets the same line).

No Dependabot config: the rollout goes without it for now; pins are bumped by hand.

Verification

• zizmor . reports no findings under the regular persona with zizmor 1.30.1 and 1.32.0. The pedantic persona keeps one low-severity note that publish-pypi.yml has no concurrency group; intentional for a tag-triggered release workflow.
• persist-credentials: false is the one behavioural change: no step in these workflows uses the job token for git operations. The existing CI jobs on this PR are the regression test.

[Denis-Averin]

CI status note: the failing test jobs are not this PR's.

What fails: Build and test (3.9) and every Test (<os>, <version>) matrix entry of "Latest Python Support". Each one reports 11 failed, 64 passed: the failures are ApiException: (401) from api.aspose.cloud with "message":"invalid_token","description":"The token expired"; the offline tests pass. Note that the matrix itself was built correctly, so the env: VERSIONS change in python-latest.yml works.

Why it is not this PR's: TEST_CONFIGURATION_ACCESS_TOKEN is the organization secret holding a short-lived JWT that ReleaseWorkflow.md says to refresh less than 24 hours before running the integration tests. It was last refreshed for Release 26.10 (2026-10-19), so the same jobs fail identically on main today. This PR only changes workflow metadata (permissions, persist-credentials, job names, concurrency, the two action pins), the publish workflow's permissions and cache setting, and adds the zizmor/Dependabot files; the token is read and passed exactly as before.

Fix: refresh the organization secret (release workflow step 3), then re-run the failed jobs. Nothing to change in this PR.

Green on this head: Run zizmor, Check badges, Twine check, Get Python versions.