Enable OpenSSF Scorecard code scanning alert and badge

[joycebrum]

Hi @mihaimaruseac, I am Joyce Brum, from Google, and I would like to suggest the use of the OpenSSF Scorecard for your project.

The OpenSSF Scorecard is a tool to search and manage security risks in the repository processes, it is developed by the OpenSSF, a non-profitable foundation dedicated to improve the overall security of the open source comunity.

The main benefit of the Scorecard is the automatic checks (you can see more about which checks are made and why in https://securityscorecards.dev/#the-checks) that help you track security vulnerabilities and how to manage or solve them.

Besides that, there is a badge that are completely optional (which I've added in the README file), but that can be a very useful way to show your commitment to secure practice, please have a look on Show Off Your Security Score: Announcing Scorecards Badges to better understand of the advantages of the badge.

Please, feel free to reach me out in case of any doubt.

[mihaimaruseac]

Hello :)

Thank you very much. I will review the PR and merge it shortly

I'm also looking at how best to add SLSA attestations (based on https://github.com/mihaimaruseac/slsa-lvl3-generic-provenance-in-haskell-example and https://github.com/slsa-framework/slsa-github-generator where I've worked on some issues) but first need to improve the CI with GitHub Actions :)