docs: add OpenSSF Security Baseline compliance assessment

[HayimShaul]

Documents where Panurus stands against the OpenSSF Open Source Project Security Baseline (OSPS Baseline) v2026.02.19, so contributors and consumers can see which security practices are in place and which are still missing.

Adds docs/openssf/ with an index page and one page per Baseline level:

• README.md — separates the OSPS Baseline from the separately tracked OpenSSF Best Practices Badge (the two are frequently conflated), records that the project targets Level 2 in full, summarises the per-level tallies, groups the findings into six gap themes, and gives a procedure for re-running the assessment.
• baseline_level_1.md / baseline_level_2.md / baseline_level_3.md — all 64 controls with a status and per-row evidence.

Every Met row cites a file, a release artifact, or a publicly readable GitHub setting. Controls that depend on organization settings or on channels outside the repository are marked Unverified rather than assumed, so the tables can be trusted as evidence.

Current state: Level 1 20/24 met, Level 2 11/19 met, Level 3 3/21 met.

Concrete gaps the assessment surfaced:

• The only required status check on main is DCO; the ruleset that additionally required CodeQL has enforcement: disabled, and required_approving_review_count is 0 despite the documented One Approve Policy.
• Release tags are lightweight commits rather than signed tag objects, and releases publish no checksum manifest, no SBOM and no VEX.
• tests.yml interpolates the workflow_dispatch input fsc-version directly into a run: step instead of passing it through env:.
• tests.yml, md_links.yml and protect-integration-test-types.yml declare no permissions:.

Also registers the new pages in mkdocs.yml under a new Security nav section — which incidentally de-orphans the existing docs/security/selector_resource_limits.md page — and links them from docs/README.md, SECURITY.md and CONTRIBUTING.md.

Docs-only change: no Go code is touched. make checks, make lint and mkdocs build --strict all pass locally.

Fixes #1626

[github-actions]

📊 Token Validation Benchmark

Comparison of this PR against the base branch. 🟢 improvement · 🔴 regression · ➖ within ±1.0% noise.

Variant	Benchmark	Params	Workers	TPS (base → PR)	Δ TPS
csp	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	106 → 106	➖ -0.2%
csp	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	116 → 115	➖ -0.2%
ipa	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	78 → 78	➖ +0.4%
ipa	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	68 → 68	➖ +0.1%

[HayimShaul]

@adecaro I saw you closed #1579 for the same issue saying it would be resurrected in the future. Not sure what you meant. Let me know what to do with this PR