workflows: add scorecard and codeql

[tkatila]

Tweak token permissions and add scorecard badge.

[tkatila]

CodeQL and scorecard, and scorecard badge tested on my private project. Dependabot badge didn't function in the private project, but copied the link from a functioning project.

[codecov-commenter]

Codecov Report

Merging #1597 (e364014) into main (f9bc72f) will not change coverage.
The diff coverage is n/a.

❗ Current head e364014 differs from pull request most recent head 89f8f26. Consider uploading reports for the commit 89f8f26 to get more accurate results

@@           Coverage Diff           @@
##             main    #1597   +/-   ##
=======================================
  Coverage   51.69%   51.69%           
=======================================
  Files          42       42           
  Lines        4869     4869           
=======================================
  Hits         2517     2517           
  Misses       2206     2206           
  Partials      146      146           

📣 Codecov offers a browser extension for seamless coverage viewing on GitHub. Try it in Chrome or Firefox today!

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[tkatila]

Hold this. I'll rewrite the structure so that it is more inline with the overall file structure.

[mythi]

was there a badge for dependabot too?

[tkatila]

was there a badge for dependabot too?

I couldn't find instructions for it. And it seems it might be broken at the moment: dependabot/dependabot-core#1912