ci: add OSSF scanning

[nschonni]

Description

Recommendation from https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

Motivation and Context

Related to #2208

Testing Details

Example Output(if appropriate)

Types of changes

• Documentation
• Version change (Update, remove or add more Node.js versions)
• Variant change (Update, remove or add more variants, or versions of variants)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Other (none of the above)

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING.md document.
• All new and existing tests passed.

[Copilot]

Pull Request Overview

This pull request adds a new GitHub Action workflow for OSSF supply-chain security scanning.

• Introduces a new workflow file (.github/workflows/scorecard.yml) for running Scorecard analysis.
• Schedules periodic runs and configures artifact upload and code scanning integration.