Repository security practice score

Scores security practices from the file list and content you provide, following the OpenSSF Scorecard idea: security policy, license, continuous integration, branch protection, dependency update tool, pinned versions in package.json, CODEOWNERS, README, and a dangerous pull_request_target trigger in workflows. Every check gets a 0–10 score with a reason and evidence, checks without data are marked not applicable, and the overall score is the mean of the scored checks.