ci(runner-test): run the zizmor job on a docker-enabled runner

zizmor needs a docker daemon and the plain aws-public image has none, so the job died on
/var/run/docker.sock. Move ci-sast to the 1cpu docker pool and register the label with actionlint.

The Speculos e2e job fails the same way on 16cpu and is left alone for now.

Author: lewisd5

.github/actionlint.yml

@@ -7,6 +7,7 @@ self-hosted-runner:
     - ledger-live-linux-e2e-speculos-32CPU-128RAM
     - ledger-live-linux-e2e-8CPU-32RAM
     - ledger-wallet-1cpu-aws-public
+    - ledger-wallet-1cpu-aws-public-docker
     - ledger-wallet-2cpu-aws-public
     - ledger-wallet-4cpu-aws-public
     - ledger-wallet-8cpu-aws-public

.github/workflows/test-additional.yml

@@ -74,7 +74,7 @@ jobs:
 
   ci-sast:
     name: Test CI Scripts
-    runs-on: ledger-wallet-1cpu-aws-public
+    runs-on: ledger-wallet-1cpu-aws-public-docker
     needs: changes
     if: needs.changes.outputs.workflow-files == 'true'
     permissions: