security(scorecard): pin dependencies, enforce read-all permissions, add CodeQL and OSV policy - #15

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d, github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/