ci: scan pull requests for credentials and injection with ThreatCrush

[ralyodio]

Adds a pull-request workflow that scans the diff for hardcoded credentials,
injection, SSRF and unsafe deserialisation. Results go to the Security tab as
SARIF and to a comment on the pull request.

It is report-only. failOn is empty, so it annotates and never fails a build.
A repository with pre-existing findings should get a report on its first install,
not a blocked pull request — a gate that fires on everything gets switched off
within a day. Tighten it to critical,high in the workflow once any backlog is
triaged.

• .github/workflows/threatcrush-scan.yml — the workflow
• .github/scripts/threatcrush-to-sarif.py — a compatibility shim for CLI versions
  older than native SARIF output; unused once the installed CLI can emit it itself

Permissions are least-privilege (contents: read, pull-requests: write,
security-events: write). It runs on pull_request, not pull_request_target,
so contributor code never executes with your secrets in scope. The SARIF upload
is continue-on-error and degrades quietly where code scanning is unavailable.

Disclosure: I maintain ThreatCrush.
It is free and MIT, and the workflow installs it from npm — nothing here phones
home. If this is not something you want, closing it is the right answer, and I
will not send another.