Add OpenSSF Scorecard workflow

[dougborg]

Part of #952.

OpenSSF Scorecard continuously scores the repo on supply-chain best practices: pinned dependencies, token permissions, branch protection, dangerous workflow patterns, signed releases, etc. Results land in the security tab and as a badge.

Task

• Add the ossf/scorecard-action workflow (scheduled weekly + on push to main), SARIF upload to the security tab.
• Optionally publish the score badge in the README.

Acceptance

• Scorecard runs weekly and uploads SARIF.
• Initial score reviewed; low-hanging items folded into sibling Supply-chain hardening for CI/CD (umbrella) #952 sub-issues.