Add OpenSSF Scorecard

[StefanSchroeder]

As suggested by

https://openssf.org/blog/2020/11/06/security-scorecards-for-open-source-projects/

add a scorecard:

https://github.com/ossf/scorecard

We can break this down into several sub-tasks:

• [ ] Security-MD | Does the project contain a security policy?
• [ ] Contributors | Does the project have contributors from at least two different organizations?
• [ ] Frozen-Deps | Does the project declare and freeze dependencies?
• [ ] Signed-Releases | Does the project cryptographically sign releases?
• [ ] Signed-Tags | Does the project cryptographically sign release tags?
• [ ] CI-Tests | Does the project run tests in CI?
• [ ] Code-Review | Does the project require code review before code is merged?
• [ ] CII-Best-Practices | Does the project have a CII Best Practices Badge?
• [ ] Pull-Requests | Does the project use Pull Requests for all code changes?
• [ ] Fuzzing | Does the project use OSS-Fuzz?
• [ ] SAST | Does the project use static code analysis tools, e.g. CodeQL?
• [ ] Active | Did the project get any commits and releases in last 90 days?