feat: add OpenSSF Scorecard security analysis

[isanchez31]

Summary

• Add OpenSSF Scorecard workflow that scores repository security health (0-10) across 20+ checks including branch protection, dependency updates, CI tests, code review, and more
• Results are uploaded as SARIF and appear in the GitHub Security tab alongside existing CodeQL findings
• Runs on push to main and weekly on Saturdays, enabling continuous security posture monitoring
• Enables adding an OpenSSF Scorecard badge to README later

Test plan

• Verify workflow syntax is valid by checking the Actions tab after merge
• Confirm Scorecard results appear in the Security tab after first run on main
• Verify the workflow does not interfere with existing CI, CodeQL, or release-please workflows

🤖 Generated with Claude Code