chore(ci): add OpenSSF Scorecard workflow

[maw629]

Adds .github/workflows/scorecard.yml running the ossf/scorecard-action on a weekly schedule, on pushes to main, and when branch protection rules change. Results are written to three places:

1. OpenSSF's public dataset (via publish_results: true) — so the score becomes queryable at https://api.securityscorecards.dev/projects/github.com/fastify/fast-uri.
2. This repo's GitHub Security tab — SARIF uploaded via github/codeql-action/upload-sarif.
3. A run artifact (results.sarif, 5-day retention) — convenient for inspecting findings without leaving the Actions page.

This to fix

GitHub's dependency-review action shows the Scorecard column as Unknown for any consumer that depends on fast-uri.

Verification I ran locally

Ran the same checks the workflow will run, locally with the scorecard CLI:

scorecard --repo=github.com/fastify/fast-uri --show-details

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[Fdawgs]

This is something that could be rolled into the shared workflows in https://github.com/fastify/workflows/ if it's something we wanted to pursue. Then we could have it across all Fastify repos.

[Copilot]

Pull request overview

Adds an OpenSSF Scorecard GitHub Actions workflow that runs weekly, on pushes to main, and on branch protection rule changes. Results are published to OpenSSF's public dataset, uploaded to the GitHub Security tab via SARIF, and stored as a run artifact. This resolves the "Unknown" Scorecard column shown by the dependency-review action for consumers of fast-uri.

Changes:

• New workflow file .github/workflows/scorecard.yml invoking ossf/scorecard-action@v2.4.3.
• Configures read-all default permissions with scoped security-events: write and id-token: write for the analysis job.
• Uploads SARIF to GitHub Security tab and as a 5-day retention artifact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Tony133]

This is something that could be rolled into the shared workflows in https://github.com/fastify/workflows/ if it's something we wanted to pursue. Then we could have it across all Fastify repos.

I agree 😉👍🏻

[Tony133]

see this PR here: fastify/workflows#222