epic: supply chain security

[bgauduch]

Status tracked in #106.

Objective

Harden the image's supply-chain security: vulnerability scanning, SBOM, image signing, a disclosure policy, and least-privilege in the CI/CD workflows.

Tasks

• Add aquasecurity/trivy-action to build-test.yml — scan the built image, fail on CRITICAL
• Generate an SPDX-format SBOM with anchore/sbom-action, attached as an artifact to GitHub releases
• Sign published images with sigstore/cosign keyless (GitHub Actions OIDC)
• Create SECURITY.md — responsible-disclosure policy, response times, contact (already delivered via docs: Phase 1 governance — contributing, security, branch policy, issue forms #120)
• Add explicit least-privilege permissions: to every job of every workflow
• OpenSSF scorecard.yml workflow to measure the open-source security posture (carried over from epic: documentation et gouvernance #105)