add support for OpenSSF Security Scorecards

See https://github.com/ossf/scorecard-action

Suggested checks to run:

```shell
scorecard \
    --repo="github.com/workloads/github-organization" \
    --checks="Binary-Artifacts,Branch-Protection,CI-Tests,Code-Review,Contributors,Dangerous-Workflow,Dependency-Update-Tool,License,Maintained,Pinned-Dependencies,SAST,Security-Policy,Token-Permissions,Vulnerabilities,Webhooks"
```