thumbnail zizmor would have caught the Ultralytics workflow vulnerability