ci: restore SHA-pinned OpenSSF Scorecard workflow

Scorecard workflow was missing from main - all 15 open alerts (#1-#15)
are anchored to stale commit d5a43ef. Restoring scorecard.yml with all
actions SHA-pinned will trigger a fresh Scorecard run that re-evaluates:
  - Token-Permissions (#14, #15): permissions already set in ci.yml + codeql.yml
  - Branch-Protection (#1): branch protection already enabled via API
  - Pinned-Dependencies (#2-#9): ci.yml + codeql.yml already SHA-pinned
  - Pinned-Dependencies (#10-#13): scorecard.yml now SHA-pinned

Actions pinned:
  actions/checkout           de0fac2e  # v6
  ossf/scorecard-action      62b2cac7  # v2.4.0
  actions/upload-artifact    ea165f8d  # v4
  github/codeql-action/...   9e907b5e  # v3

Author: jovanSAPFIONEER

.github/workflows/scorecard.yml

@@ -0,0 +1,45 @@
+name: OpenSSF Scorecard
+
+"on":
+  push:
+    branches: [main]
+  schedule:
+    - cron: '30 5 * * 1'  # Every Monday at 05:30 UTC
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46  # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6  # v3
+        with:
+          sarif_file: results.sarif