docs: add OpenSSF Scorecard and Best Practices Badge to README.md

[gregorywaynepower]

[neteler]

Thanks for your contribution!

[gregorywaynepower]

Thanks for accepting it! Y'all be interested in a pull request implementing the Open Source Security Foundation's Github Action?

[echoix]

Just changed the title to have it categorized in the release notes ;)

[gregorywaynepower]

Thanks @echoix for the correction!

[echoix]

And yes, I’d be glad to see a PR for this. Do you know about how much time it runs? And is it triggered on schedule, or per PR? I’ve juste read about the scorecard and is interesting to point out where to improve.

[gregorywaynepower]

@echoix I haven't spent time benchmarking how long it takes to run, I haven't found it to be a hassle.. The GitHub Action can be set to run on a schedule and on pushes to the repo. Pull Requests are currently experimental. It provides the same checks as the CLI tool, but it also automates configuration of YML files to provide minimum permissions provided by StepSecurity which is pretty snazzy and automates a huge chunk of the Github Action configuration.

I'm currently working on this for QGIS (qgis/QGIS#55748), once I'm done with them I'll have time to work with y'all.