ci(scorecard): namespace the SARIF upload and align the action version

[msalvatti]

Last piece of the Code scanning cleanup. All 11 open Scorecard alerts are now closed — the repo matches nest-notification, nest-cache and nest-logger, which each sit at zero.

What this PR changes

The Scorecard SARIF was uploaded with no category, so it landed in the default analysis set: every upload replaces whatever was there before, and its findings sit in the Security tab beside CodeQL's with nothing distinguishing the two tools. nest-notification and nest-cache both declare category: ossf-scorecard; this brings the third in line.

Also moves upload-sarif 4.37.3 → 4.37.4, the version init and analyze already run. It only trailed because it lives in scorecard.yml and was bumped by a separate Dependabot PR (#45).

How the 11 alerts were resolved

Five were already fixed by earlier work this session — the missing LICENSE (#27), the vulnerable transitives (#43), and 5 of the 10 Pinned-Dependencies (SHA pinning in #27/#29). The remaining eleven were dismissed as won't fix, each with a verified reason, following the playbook nest-notification established:

Alert	Why it is dismissed
Branch-Protection (High)	Protection is ruleset-only — no classic branch protection exists, and Scorecard reads the classic API. Verified: GET /branches/main/protection → 404, while nest-queue-pr-and-ci-gates has bypass_actors: []. So "applies to administrators" is in fact enforced and Scorecard cannot see it. The four approval-based warnings need a second maintainer.
Code-Review (High)	GitHub forbids approving your own PR; requiring approvals would deadlock every PR including Dependabot's. Main requires the full CI pipeline instead, and every Copilot thread is answered before merge.
Maintained (High)	Time-based only: repository created 2026-05-27, so it is under 90 days old. Clears itself around 2026-08-25.
Pinned-Dependencies ×5 (Medium)	All five are first-party bymaxone/.github refs kept on the @v1 moving tag by design, so org-wide fixes propagate without a PR per repo. Verified: every other uses: in the repo is SHA-pinned.
SAST (Medium)	Historical ratio (16/27) because CodeQL was added after the first commits. codeql.yml now runs on every push to main, every PR and weekly, with zero findings.
Fuzzing (Medium)	The library parses no untrusted input — job payloads are opaque and never decoded, and cron parsing is delegated to BullMQ's own parser rather than a hand-rolled one.
CII-Best-Practices (Low)	Requires the maintainer to self-enroll at bestpractices.dev; cannot be satisfied from the repository.

One thing left on the table, deliberately

Scorecard also warns that up-to-date branches is off (strict_required_status_checks_policy: false). That one is genuinely actionable — but turning it on forces every PR to be rebased onto the latest main before it can merge, which on a repo taking ~10 Dependabot PRs a week is real friction. nest-notification does not enable it either. Flagging rather than changing it: it is a workflow decision, not a defect.

---

Ready for your review — not merging it.

[Copilot]

Pull request overview

Aligns the Scorecard workflow’s SARIF upload with the repository’s CodeQL action versions and ensures Scorecard results appear as a distinct code-scanning analysis set (instead of overwriting / mixing with the default set).

Changes:

• Add category: ossf-scorecard to the SARIF upload step to namespace Scorecard findings into their own analysis set.
• Bump github/codeql-action/upload-sarif from v4.37.3 to v4.37.4, matching the v4.37.4 SHA already used by init/analyze elsewhere in the repo.