OSSF scorecard - PR ready for review

[planetf1]

The PR containing the ossf scorecard work is now ready for review.

• OSSF Scorecard is now run as part of the PR
• Github actions are now referred to by SHA (required for a reproducible build)
• Python dependences are now referred to by SHA
• We pass 10/10

There's still some followons to address, but in a followon PR (imo!)

• Resetting the trigger - it will not be run in a PR, but periodically and/or after merge (follow ossf recommendation)
• Publishing the results to OSSF (simple change)
• Creating security issues (security tab in github) with any future regressions (simple change)
• Optionally adding a link to a 'badge' from within our docs or readme
• Adding process docs (where?) to explain how to pin dependencies, and some useful tools
• Rolling out the approach to other repos

Any questions? I can explain at a future dev or tsc call as needed either before or after pr merge, depending on feedback

[baentsch]

In general, OQS has very few contributors -- accordingly, discussions are probably getting least attention. FWIW, I personally more quickly respond to issues and PRs as those have a direct impact on actual code. It would be nice if someone were willing to change this, i.e., actively "manage" OQS discussion topics from opening to closure as a way of contributing (I personally do it only when there's bad weather :-)

Closing this topic as resolved (yes, it's raining :).