Add OpenSSF Scorecard monitoring and publish the results

[itsjling]

Problem

There is no OpenSSF Scorecard result for github.com/itsjling/diffsplain; the public Scorecard API returns 404. That leaves the project without a standard, check-by-check security baseline.

Scope

• Add the official OpenSSF Scorecard GitHub Actions workflow.
• Pin every third-party action in the new workflow to a full commit SHA and keep the release tag in a comment.
• Use read-only default permissions and grant only the job permissions needed to upload SARIF and publish results.
• Set publish_results: true so the public API and viewer expose the result.
• Upload findings to GitHub code scanning.
• Run on the official recommended triggers and a weekly schedule.
• Add a short link to the result in product docs if it helps users; keep the root README focused on command use and local development.

Acceptance checks

• The workflow completes on main.
• Findings appear in the repository Security tab.
• https://api.scorecard.dev/projects/github.com/itsjling/diffsplain returns a result.
• Each reported check includes its score and reason.
• File follow-up issues for high-risk findings; do not chase the aggregate score when a check does not fit this CLI.
• corepack pnpm run lint and corepack pnpm test pass.

Repository rule

This changes .github/workflows/, so review the workflow as untrusted automation and add the automation-reviewed label before merge.