Add the OpenSSF Scorecard Action

[pnacht]

I'm back (see #4191, #4194 and #4273) with another security suggestion!

I managed to detect all of these possible improvements by using the OpenSSF Scorecard. It's a tool that runs a sort of "meta-analysis" of the repo's security-posture and gives actionable suggestions on how to improve.

The tool is also available as a workflow Action that scans the repo after every commit to make sure there aren't any hiccups. Anything it detects gets sent to the project's Security Panel for easy access and management.

Spoiler alert: harfbuzz currently gets a 7.1/10, which puts it in the top 10% of relevant projects!

[behdad]

Sounds good to me. :D