Revert "CI: remove code scanning again"

This reverts commit c5b593a34c.

try the suggestion from
https://github.com/woodruffw/zizmor/discussions/291

.github/workflows/test.yml

@@ -53,6 +53,12 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        run: pipx run zizmor .
+        run: pipx run zizmor --format sarif . > results.sarif
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor