ci: security scanning, with the findings read and justified

.github/security-baseline

@@ -0,0 +1,4 @@
+# Security scan baseline (keel-linux/.github, security-scan.yml): findings
+# that were read and are not a risk, one per line, the fingerprint and why.
+shellcheck:SC2046:overlay/usr/local/sbin/tkldev-squid-refresh:75b6d212d184 shell lint, not a security risk: unquoted command substitution over values the script itself produces
+shellcheck:SC2061:overlay/usr/local/sbin/tkldev-squid-refresh:acf806da4ae7 shell lint, not a security risk: unquoted -name pattern to find, a correctness defect

.github/workflows/security.yml

@@ -0,0 +1,19 @@
+# Security scanning (keel-linux/.github, profile/WORKFLOWS.md "Security
+# scanning"): gitleaks, bandit, semgrep and shellcheck on GitHub-hosted
+# runners, no secrets. Findings that are not a risk are listed, each with its
+# justification, in .github/security-baseline; gitleaks fixtures, if any, in
+# .github/gitleaks.toml.
+name: security
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  security:
+    uses: keel-linux/.github/.github/workflows/security-scan.yml@main
+    permissions:
+      contents: read
+      security-events: write