[codex] Harden Scorecard workflow integration

[andrewkoltsov]

Summary

• add the public OpenSSF Scorecard badge and report link to the README
• pin GitHub Actions references to immutable commit SHAs
• scope write-level workflow permissions down to the jobs that actually need them
• record the repository-facing change in the changelog

Why

The repository already had a Scorecard workflow, but the current Scorecard report was still penalizing the project for unpinned workflow dependencies and broad workflow token scope. This PR makes the integration visible to users and addresses the workflow hardening issues that can be fixed in-repo.

Validation

• npm run lint
• npm run build
• npm run test:coverage
• npm run pack:check
• npx prettier --check .github/workflows/ci.yml .github/workflows/codeql.yml .github/workflows/release.yml .github/workflows/scorecard.yml README.md CHANGELOG.md

Notes

• npm run validate in the local checkout is blocked by an unrelated untracked .tasks/README.md formatting issue that is not part of this PR and will not exist in GitHub Actions.
• The latest public Scorecard run on master predates this branch, so the score should be re-checked after merge or after a run against this branch.