Add Plumber to watch workflow security

[Totara-thib]

Companion to #1050: the check added here flags the two unpinned actions until the pins land, then it goes green.

This adds Plumber to CI, the tool I used to find the unpinned actions in the first place. It scans the workflows on each push to master and on each PR, and fails when something regresses: an unpinned action, an archived dependency, a known CVE, that kind of thing.

• plumber.yml: pinned by sha, minimal permissions, findings go to the security tab as SARIF (skipped on PRs from forks, the report stays as an artifact there).
• .plumber.yaml: generated defaults scoped to this repo: ruby/setup-ruby is on the trusted sources allowlist, and the branch protection control is off with a note in the file, the CI token cannot read those settings.
• README.md: one line, the score badge next to the gem and build ones.

Score badge

I enabled score-push on the action: every run, on any branch, publishes the score to score.getplumber.io, and that feeds the badge in the README. Scores are public and the badge always shows the state of master. A failed publish never fails your CI. Until the first run on master the badge reads UNKNOWN in gray, then it flips to the grade. If you would rather not have it, drop the README line and the score-push input, the rest works the same.

With the pins in, this runs green with a score of A. Set soft-fail: true if you prefer report only, without gating PRs.

To be fully transparent: I work on Plumber. If you do not want the tool in your CI, no hard feelings, the pinning PR is the one that matters and it stands on its own.

---

Before submitting the PR make sure the following are checked:

• The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
• Wrote good commit messages.
• Commit message starts with [Fix #issue-number] (if the related issue exists).
• Feature branch is up-to-date with master (if not - rebase it).
• Squashed related commits together.

[AlfonsoUceda]

Thank you so much @Totara-thib going to merge it because it will help us to get the workflows more secured.

[Totara-thib]

Thank you so much @Totara-thib going to merge it because it will help us to get the workflows more secured.

I'm really glad it could help! If you have any feedback or if you're looking for someone to maintain it, don't hesitate to reach out.