Feat: Update README and add workflow for scorecard

[JosephMaynard]

Summary by CodeRabbit

Chores

• Integrated OpenSSF Scorecard GitHub Actions workflow for automated security assessments
• Added status badges to README (npm version, CI status, OpenSSF Best Practices, Scorecard status, and MIT license)
• Documented testing expectations in development guidelines for user-facing and dependency-related changes

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de8ca2b2-ca0f-4619-bfc3-dda622369fa6

📥 Commits

Reviewing files that changed from the base of the PR and between e896267 and 5786672.

📒 Files selected for processing (2)

• .github/workflows/scorecard.yml
• README.md

---

📝 Walkthrough

Walkthrough

This PR adds OpenSSF Scorecard integration to establish automated security analysis as part of the CI pipeline, runs weekly and on pushes to master, and documents testing expectations for contributors. The workflow runs the scorecard action and uploads results to GitHub. README updates include status badges and guidance on when to include automated tests.

Changes

OpenSSF Scorecard Integration and Testing Documentation

Layer / File(s)	Summary
OpenSSF Scorecard workflow .github/workflows/scorecard.yml	New GitHub Actions workflow runs ossf/scorecard-action (v2.4.0) on master pushes, weekly schedule, and manual dispatch with least-necessary permissions (contents: read, security-events: write, id-token: write), then uploads SARIF results to GitHub.
Status badges and testing guidance README.md	Header adds npm version, CI, OpenSSF Best Practices, OpenSSF Scorecard, and MIT license badges. Development section introduces "Testing expectations" subsection requiring automated tests for user-facing changes and fixture tests for dependency-graph, package-manager, report-output, and supply-chain-related changes.

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly Related PRs

• JosephMaynard/dependency-radar#21: Overlaps on README.md edits, particularly the Development section; review ordering may benefit from checking prior README changes.

Poem

🐰 A shield of badges now adorns the way,
With Scorecard checks run every single day,
Tests guide the path where changes flow,
Security and quality, side by side they grow! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes both main changes in the PR: updating the README with new badges and testing expectations, and adding the OpenSSF Scorecard GitHub Actions workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/update-readme-for-scorecard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}