fix Scorecard findings: permissions and pinned dependencies

[iicky]

• Add permissions: read-all to ci, release, codeql, python, node workflows
• Pin github/codeql-action to full SHA
• Add LICENSE pointer file for badge detection
• Add OpenSSF Best Practices badge to README
• Add SLSA Level 2 badge and document provenance in THREAT_MODEL
• Extend vulnerability response SLA from 7 to 14 days
• Require tests for new features (should → must) in CONTRIBUTING
• Add DCO reference to CONTRIBUTING
• Add ROADMAP.md (near-term, someday, non-goals)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.41%. Comparing base (bae353d) to head (fb127ee).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.