Proposed improvements to OpenSSF Scorecard

[lucasgonze]

To decide whether to use this package in the Magma project I checked it with deps.dev.

(See https://deps.dev/go/github.com%2Fwmnsk%2Fmilenage/v1.2.0). These changes would improve the results:

1. project should require code review before pull requests (aka merge requests) are merged.
2. acquire OpenSSF (formerly CII) Best Practices Badge.
3. enable branch protection development/release branches
4. pin all dependencies by hash. (some dependencies are pinned by hash, but not all).
5. enable CodeQL in Github
6. create security policy in Github
7. implement fuzzing

I would be glad to help with these if you would like.

[wmnsk]

Great! Which can you help me with setting up?

[lucasgonze]

Ok. Can you add me as assignee?