[AdepuSriCharan]

Description

This PR adds an OpenSSF Scorecard workflow to assess the Python SDK repository's supply-chain security.

The workflow runs on pushes to main, weekly schedules, and branch-protection changes. It is configured to publish Scorecard results using OIDC, upload SARIF findings to GitHub Code Scanning, and retain the SARIF report as an artifact for five days.

The workflow also:

• Skips forks, which the official Scorecard action does not support.
• Pins all actions to full commit SHAs with version comments.
• Uses read-only permissions by default, with explicitly scoped job permissions.
• Disables persisted checkout credentials.
• Leaves existing CI workflows and SDK functionality unchanged.

Validation:

• actionlint 1.7.12 passed.
• Zizmor 1.31.1 offline regular-mode security audit passed.
• Ruff lint and formatting passed.
• Mypy passed for 228 source files.
• Existing non-e2e suite: 2,102 tests and 80 subtests passed; 41 e2e deselected.
• Git whitespace checks passed.

Zizmor's auditor mode identified two non-blocking findings: the issue-required read-all default and optional concurrency control. The analysis job explicitly limits its token permissions.

Live publication and Code Scanning uploads will need to be verified upstream after merging, as the official Scorecard action does not support running on forks.

Issue reference

Closes #1332

Checklist

• Workflow configuration validated with actionlint and Zizmor.
• Local static checks and existing regression tests passed.