Enable OpenSSF Scorecard Github Action

[joycebrum]

Closes #8255

As discussed in the #8255 here are the changes to enable the Scorecard GitHub Action and the badge to the repo.

The changes are:

• A configuration file in .github/workflow to enable the action
• the badge in the README file

Thanks for considering it and any doubts or concers I'll be happy to help.

[trivialfis]

Hi @joycebrum , the security workflow is failing but scanning the log I'm not sure what we can do to fix it, could you please help take a look when you are available?

https://github.com/dmlc/xgboost/actions/runs/3343582033/jobs/5536950640

[joycebrum]

Hi @joycebrum , the security workflow is failing but scanning the log I'm not sure what we can do to fix it, could you please help take a look when you are available?

https://github.com/dmlc/xgboost/actions/runs/3343582033/jobs/5536950640

Hi @trivialfis I'll take a look at it

[trivialfis]

Thank you!

[joycebrum]

As I've seen it has something to do with sigstore/cosign#2390, I've tried to upgrade the scorecard github action to 2.0.6 and it seemed to work https://github.com/joycebrum/xgboost/actions/runs/3347671832

I've openned the PR #8402 with the fix