chore: add OpenSSF trust baseline

[dzeusking-dev]

Summary

Add the repository-specific OpenSSF trust baseline without changing runtime behavior:

• official pinned Scorecard workflow with public result publication and SARIF upload;
• pinned CodeQL and dependency review workflows;
• project-specific support, governance, maintainer, threat-model and trust documentation;
• validated Security Insights v2.2.0 metadata;
• evidence-only Best Practices / OSPS automation proposals.

Verification

• python -m compileall csaf_check
• python -m pytest -q (11 passed, 1 skipped because the optional real validator is not installed locally)
• python -m build
• actionlint 1.7.12
• Security Insights CUE schema validation
• diff-only gitleaks 8.30.1: no leaks
• local documentation links resolve

Authorization And Ethics

• This concerns the canonical public repository.
• This keeps csaf-check read-only for v0.x.
• This adds no third-party discovery or protected artifact retrieval.

Non-claims

This change is not a certification, does not prove the project is vulnerability-free, does not claim a SLSA or OpenSSF badge level, and does not imply OpenSSF endorsement. No README Scorecard badge is added until a public default-branch result exists.

Rollback

Revert the merge commit. No release, tag, version, secret, product behavior or external service is changed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.