fix: allow zizmor scans with no auditable inputs

[Copilot]

Pull Request

Description
A consuming repository with no auditable GitHub Actions or Dependabot inputs currently fails the central zizmor required workflow with error: no inputs collected, blocking an otherwise valid PR. This updates the workflow to treat the no-inputs case as non-failing while preserving normal gating for real findings.

• Workflow behavior

  • Set fail-on-no-inputs: false on both zizmor-action invocations
  • Keep the existing scan/gate behavior unchanged when auditable inputs do exist

• Documentation

  • Document that repositories with no auditable inputs now pass with a warning instead of failing

• Example

  with:
    advanced-security: false
    annotations: true
    fail-on-no-inputs: false

Related Issue

Type of Change
Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• Documentation update

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Additional Context
This is a minimal workflow-only fix: no policy thresholds changed, and zizmor still fails the job for actual findings at or above the configured severity.

• Fixes No inputs collected error #10