ci: treat Branch-Protection as a one-maintainer Scorecard residual (#44)

A second human reviewer is not available in this org. Keep the live
gate at one review plus the maintainer bypass, and strip
BranchProtectionID from the code-scanning upload so weekly Scorecard
does not reopen it.

Author: agjs

.github/workflows/security-scorecard.yml

@@ -35,17 +35,17 @@ jobs:
           path: scorecard-results.sarif
           retention-days: 5
       # Full Scorecard still publishes to scorecard.dev. These checks cannot
-      # reach 10 on a one-maintainer template (second human reviewer, CII badge
-      # signup, historical CI/SAST coverage, fuzzing). Strip them from the
-      # GitHub code-scanning upload so weekly runs do not reopen accepted risk.
+      # reach 10 on a one-maintainer org (no second reviewer, CII badge signup,
+      # historical CI/SAST coverage, fuzzing). Strip them from the GitHub
+      # code-scanning upload so weekly runs do not reopen accepted risk.
       - name: Filter residual Scorecard rules from code scanning
         run: |
           jq '
             .runs |= map(
               .results |= map(
                 select(
                   .ruleId as $id
-                  | ["CodeReviewID", "CIIBestPracticesID", "SASTID", "CITestsID", "FuzzingID"]
+                  | ["CodeReviewID", "CIIBestPracticesID", "SASTID", "CITestsID", "FuzzingID", "BranchProtectionID"]
                     | index($id)
                     | not
                 )