ci: add OpenSSF Scorecard workflow and README badges

[Perseus985]

Overview

krop-controller is the only one of the three kcp controllers without an OpenSSF Scorecard workflow,
and the only one with no README badges at all. Bring it in line with its siblings.

README fixes

README.md#L5
is the line the badges would replace or sit above, and it currently advertises a registry org that does not exist:

`Status: alpha` · `License: Apache-2.0` · `Go 1.26` · `Runtime: kcp` · `Image: ghcr.io/opendefense/krop-controller`

To add:

[![Build status](https://github.com/opendefensecloud/krop-controller/actions/workflows/golang.yaml/badge.svg)](https://github.com/opendefensecloud/krop-controller/actions/workflows/golang.yaml)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/opendefensecloud/krop-controller/badge)](https://scorecard.dev/viewer/?uri=github.com/opendefensecloud/krop-controller)
[![GitHub Release](https://img.shields.io/github/v/release/opendefensecloud/krop-controller)](https://github.com/opendefensecloud/krop-controller/releases/latest)