feat: adds scorecard workflow to publish openssf scores

[gaganhr94]

Summary

The repository currently does not publish OpenSSF Scorecard results, which means users and downstream consumers cannot easily discover the project’s security best-practice signals via Scorecard API.

Publishing Scorecard results:

• Improves transparency for users and integrators
• Provides early visibility into missing or improvable security practices

Fixes #6089

[gaganhr94]

@evankanderson Can you please review this PR when you get a chance. Thanks !

[evankanderson]

This looks to mostly match the setup in github.com/ossf/scorecard/blob/main/.github/workflows/scorecard-analysis.yml minus the comments, so LGTM.

[evankanderson]

github.com/ossf/scorecard/blob/main/.github/workflows/scorecard-analysis.yml uses read-all instead of contents: read. Will contents: read prevent any of scorecard's operation?

[gaganhr94]

Thanks for pointing this out! I looked into it a bit more, and it seems that using contents: read can cause some checks to be skipped or return incomplete results, since scorecard is a complete analysis of the project. I'll keep it aligned with the scorecard workflow by changing it to permissions: read-all

[coveralls]

coverage: 58.398%. remained the same
when pulling 3e9a240 on gaganhr94:feat/adds-scorecard-workflow
into 7a1fa17 on mindersec:main.