chore: add OpenSSF Scorecard workflow

[nir-test-ac]

✏️ Changes

This pull request adds a security hardening workflow from the unified-pipeline-template (https://github.com/atko-cic/unified-pipeline-template/security). No functional changes are introduced.

OpenSSF Scorecard

This PR adds .github/workflows/scorecard.yml from the unified-pipeline-template. It calls ossf/scorecard-action directly (SHA-pinned to v2.4.3) — no composite action wrapper, no cross-org dependency. Results are uploaded to the Code Scanning dashboard via github/codeql-action/upload-sarif.

⚠️ Before merging, review the added .github/workflows/scorecard.yml and make the changes described below, plus any other adjustments your CI environment requires.

Placeholders to fill in before merging

Placeholder	Description
publish_results: true	Set to false to keep Scorecard results private and remove the id-token: write permission. When true, results are published to the public Scorecard API (enables the badge) — requires id-token: write and a push/schedule event (not a PR)

🔮 Type of Change

• Standard

🔗 References

https://auth0team.atlassian.net/browse/SEPIO-1674

• I added at least one link (task, slack thread, etc) to explain why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb1afab0-a0f3-43ac-8fc6-a27ad249a88c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}