Add OpenSSF Scorecard security analysis workflow

[corydolphin]

Summary

This PR adds OpenSSF Scorecard integration to the repository for continuous supply-chain security monitoring and analysis.

Key Changes

• Added GitHub Actions workflow (.github/workflows/scorecard.yml):

  • Runs Scorecard analysis on push to main branch and weekly on Tuesdays
  • Uploads results to GitHub's code scanning dashboard
  • Publishes results to OpenSSF REST API for public visibility
  • Stores SARIF artifacts for 5 days
  • Uses pinned action versions for security

• Updated README.rst:

  • Added OpenSSF Scorecard badge to the status badges section
  • Badge links to the project's Scorecard report on scorecard.dev

Implementation Details

• Workflow uses minimal permissions (read-only by default) with specific elevated permissions only for necessary steps
• Scorecard action configured to output SARIF format for integration with GitHub's code scanning
• Results are published to OpenSSF's public API, allowing the repository to display the Scorecard badge
• All GitHub Actions use specific commit SHAs for reproducibility and security

https://claude.ai/code/session_01XyjhGhe5sfV6BQKgjC3SiQ