feat(ossf-scorecard): add ossf-scorecard github action integration

[smoy]

I like to propose an integration with ossf-scorecard (https://github.com/ossf/scorecard)

Inevitably, this repo will be a high blast radius target, so an automated way to vet the health of the repo will be welcomed.

This is the expected state: https://scorecard.dev/viewer/?uri=github.com/cloudiamresearch/SkillSpector once the integration is enabled.

[rng1995]

Approving — standard OSSF Scorecard workflow with good supply-chain hygiene: third-party actions are pinned to commit SHAs, default permissions: read-all, and minimal job-scoped security-events/id-token writes.

Non-blocking nits:

• The job if references github.event_name == 'pull_request', but no pull_request trigger is configured (only branch_protection_rule/schedule/push), so that clause is dead.
• File is missing a trailing newline.

[smoy]

rebase on latest upstream open source, such that it will pass lint and format.