chore: add OpenSSF Scorecard workflow

[nirmal-joishi-auth0]

✏️ Changes

This pull request adds a security hardening workflow. No functional changes are introduced.

OpenSSF Scorecard

This PR adds .github/workflows/scorecard.yml. It calls ossf/scorecard-action directly (SHA-pinned to v2.4.3) — no composite action wrapper, no cross-org dependency. Results are uploaded to the Code Scanning dashboard via github/codeql-action/upload-sarif.

⚠️ Before merging, review the added .github/workflows/scorecard.yml and make the changes described below, plus any other adjustments your CI environment requires.

Placeholders to fill in before merging

Placeholder	Description
publish_results: false	Default. Set to true to publish results to the public Scorecard API and enable the badge — also requires uncommenting id-token: write in the job permissions. Leave as false to keep results private (the id-token: write line can remain commented out).

🔮 Type of Change

• Standard

🔗 References

This change applies a standard automated security-scanning workflow as part of routine repository hardening.

• I explained why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.

[nirmal-joishi-auth0]

@auth0/project-dx-sdks-engineer-codeowner please review the files in the PR and merge the PR if all is green.