ci: add ossf scorecard workflow

[JamieMagee]

Add a workflow for OpenSSF Scorecards. This allows us to more easily follow the best security practices for open source packages.

---

Before the change?

• No insight into the scorecard result

After the change?

• OpenSSF scorecard is on every push to main, and weekly on a schedule.

Pull request checklist

• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[kfcampbell]

Out of curiosity, why OSSF?

[JamieMagee]

@kfcampbell GitHub is a founding member of the OSSF. We already contribute to a lot of projects, and use a lot of tooling from the OSSF throughout GitHub. I found OSSF Scorecard useful when working in other projects, so I thought it would be a good idea to add it here as well.

Looks like we've got a score of 8.2 already! https://scorecard.dev/viewer/?uri=github.com/octokit/webhooks.net

[kfcampbell]

Understood, thanks!