Add security policy and OpenSSF Scorecard badge

[martincostello]

• Add a security policy documenting how to report vulnerabilities.
• Add a GitHub Actions workflow to calculate the OpenSSF Scorecard score for the repository.
• Add a badge for the OpenSSF Scorecard to the README (will only work post-merge).

[codecov]

Codecov Report

Merging #496 (c1b5467) into main (58a1759) will increase coverage by 0.49%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #496      +/-   ##
==========================================
+ Coverage   94.55%   95.04%   +0.49%     
==========================================
  Files          27       27              
  Lines         606      606              
==========================================
+ Hits          573      576       +3     
+ Misses         33       30       -3     

Flag	Coverage Δ
linux	94.22% <ø> (ø)
macos	94.88% <ø> (+0.49%)	⬆️
windows	94.05% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 1 file with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more