tools: Update tidy.sh

.github/zizmor.yml

@@ -4,3 +4,4 @@
 rules:
   anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
   dependabot-cooldown: { config: { days: 14 } }
+  unpinned-images: { disable: true }