Improve OSSF Scorecard score (2.7 → ~8)

[chatch]

Summary

• SECURITY.md — adds vulnerability reporting policy (Security-Policy: 0 → ~8)
• SHA-pinned Actions — pins all GitHub Actions to commit SHAs in ci.yml and scorecard.yml (Pinned-Dependencies: 0 → ~7)
• permissions: read-all on ci.yml top-level (Token-Permissions: 0 → ~9)
• CodeQL workflow (.github/workflows/codeql.yml) — JavaScript/TypeScript SAST analysis on push/PR/weekly (SAST: 0 → ~8)
• npm publish workflow (.github/workflows/publish.yml) — triggered on GitHub releases (Packaging: -1 → ~8)
• Vulnerability fixes — vitest updated to 4.1.0 (fixes rollup); pnpm.overrides patches minimatch, ajv, undici, flatted, diff, @isaacs/brace-expansion; 22 vulns → 1 unfixable (lodash in @forge/api)
• Branch protection — enabled on main via GitHub API (requires PR + 1 review + CI passing)

Estimated score after merge: ~7.5–8.5 / 10

Check	Before	After
Security-Policy	0	~8
Token-Permissions	0	~9
Pinned-Dependencies	0	~7
SAST	0	~8
Vulnerabilities	0	~9 (1 unfixable lodash vuln in @forge/api)
Branch-Protection	0	~8
Code-Review	0	~8
Packaging	-1	~8

Remaining manual steps

• CII Best Practices badge — apply at https://bestpractices.coreinfrastructure.org/
• npm secret — add NPM_TOKEN secret in repo settings for the publish workflow
• Dependabot — can add .github/dependabot.yml later for Dependency-Update-Tool score

Test plan

• All 43 tests pass (pnpm vitest run)
• pnpm audit shows 1 remaining moderate vuln (lodash, no patch in 4.x)
• Wait for CI to pass on this PR
• Merge and trigger scorecard: gh workflow run scorecard.yml
• Check results at https://securityscorecards.dev/viewer/?uri=github.com/Eulo-Labs/forge-fsql

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.