ci: add OSSF scanning

[nschonni]

Description

Recommendation from https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

Motivation and Context

Related to #2208

Testing Details

Example Output(if appropriate)

Types of changes

• Documentation
• Version change (Update, remove or add more Node.js versions)
• Variant change (Update, remove or add more variants, or versions of variants)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Other (none of the above)

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING.md document.
• All new and existing tests passed.

[nschonni]

Note that this was from the template, and is "out of date" already, but a good test for the Dependabot bumping of the SHAs