Add workflow, repository and dependency analysis

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.

1 files changed, 2 insertions, 0 deletions

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 223f5eee..a0684b67 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,6 +21,8 @@ jobs:
         language: [actions, c-cpp]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           languages: ${{ matrix.language }}