chore: harden workflows and add a security policy

[fgouteroux]

Addresses the three OpenSSF Scorecard checks that were scoring 0 and could be
fixed without changing how the project is maintained.

Verified by re-running Scorecard against this branch:

10  Pinned-Dependencies    all dependencies are pinned
10  Security-Policy        security policy file detected
10  Token-Permissions      GitHub workflow tokens follow principle of least privilege

All three previously scored 0.

Token permissions

release.yml declared contents: write at the workflow level, so every step in
the workflow ran with a token that could write to the repository. The workflow
now defaults to contents: read, and write is granted only on the goreleaser
job, which needs it to publish the release. ci.yaml already had contents: read.

Pinned actions

The seven action references are pinned to commit SHAs, with the tag kept as a
trailing comment for readability. A mutable tag can be repointed at new code by
whoever controls the action repository; a SHA cannot.

The trade-off is that pinned actions no longer pick up updates on their own. The
github-actions Dependabot group added earlier resolves SHAs, so updates will
still arrive as pull requests.

Security policy

Adds SECURITY.md, pointing at GitHub private vulnerability reporting rather
than a public issue. The scope section is specific to what this project handles:
API authentication, private keys and token values including in logs, issuance
for domains the requester does not own, path traversal through certificate or
owner names, and cluster-level trust between nodes.

Not addressed

Four checks stay at 0 because they are workflow or infrastructure decisions
rather than fixes: Code-Review (approved changesets), Branch-Protection,
Signed-Releases (cosign in GoReleaser) and Fuzzing.

Note also that no score is published for this repository yet — api.scorecard.dev
returns 404, and the badge renders as "invalid repo path". Publishing requires
the ossf/scorecard-action workflow with publish_results: true and
id-token: write, which is deliberately left out of this PR.