security scorecard

[LarsEckart]

I just gave https://securityscorecards.dev/ a try and it's simple to setup. we could add a github action for it, and then have a look if we want to tackle some of the shortcommings it reports.