Add Scorecard reporting and security review ownership

[kwisatzh]

Summary

• Publish OpenSSF Scorecard reports from main and the weekly schedule, with pinned actions and job-scoped permissions.
• Add CODEOWNERS for security-sensitive paths as review routing only.
• Document the manual Actions-permission setting and add the Scorecard README badge.

Verification

• Actionlint and whitespace checks passed.
• README changes are limited to the badge.
• Repository settings and rulesets are unchanged. No code-owner approval requirement is introduced.
• Product work is excluded. Scorecard publication is verified after merge because it runs only on main.