Detecting the use of OneFuzz by recommending a .onefuzz file

[balteravishay]

Summary of the Pull Request

Adding recommendation to OneFUzz users how to allow automated security metrics tools such as Scorecard to detect the use of OneFuzz in their repository.

PR Checklist

• [ NA] Applies to work item: #xxx
• [v ] CLA signed. If not, go over here and sign the CLI.
• [ NA ] Tests added/passed
• [v ] Requires documentation to be updated
• [v ] I've discussed this with core contributors already. If not checked, I'm ready to accept this work might be rejected in favor of a different grand plan. Issue number where discussion took place: #xxx

Info on Pull Request

only markdown changes

Validation Steps Performed

NA

[scovetta]

Related: The OpenSSF Security Insights spec is designed to handle this type of use case -- meaning, specifying security metadata in a structured way.