ci(github): Run OpenSSF Scorecard analysis

Note that the `scorecard-action` does not currently offer conventional
major-version-only tags, so the concrete version needs to be hard-coded.

Signed-off-by: Sebastian Schuberth <[email protected]>

.github/workflows/static-analysis.yml

@@ -114,3 +114,25 @@ jobs:
       run: |
         pip install --user reuse
         ~/.local/bin/reuse lint
+  scorecard-analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for SARIF scanning upload.
+      security-events: write
+      # Needed for GitHub OIDC token if `publish_results` is true.
+      id-token: write
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Run Analysis
+      uses: ossf/[email protected]
+      with:
+        results_file: ossf-results.sarif
+        results_format: sarif
+        publish_results: true
+    - name: Upload Code Scanning Results
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ossf-results.sarif