fix: address OpenSSF Scorecard findings + add badges and release notes

[imran-siddique]

OpenSSF Scorecard Improvements (3.8 → target 7+)

Code fixes:

• Pinned-Dependencies: All 6 GitHub Actions pinned by SHA hash, all 28 Docker base images pinned by SHA256 digest
• SAST: Added CodeQL workflow (Python + JavaScript, weekly + on PR)
• Dependency-Update-Tool: Added \dependabot.yml\ covering pip, npm, and github-actions (8 ecosystems)
• Packaging: Added \publish.yml\ PyPI publishing workflow
• Binary-Artifacts: Removed \gradle-wrapper.jar\ from source
• Vulnerabilities: Bumped cryptography>=44, fastapi>=0.115, aiohttp>=3.11, httpx>=0.27, uvicorn>=0.27; removed 6 stale package-lock.json files (74 vulns → 5)

Documentation:

• Added OpenSSF Best Practices badge (project #12085)
• Added OpenSSF Scorecard badge
• Updated OWASP badge from 9/10 to 10/10
• Added v1.0.0 release notes

Scorecard projection:

Check	Before	After
Binary-Artifacts	9	10
Pinned-Dependencies	0	7-8
SAST	0	10
Dependency-Update-Tool	0	10
Packaging	-1	10
Vulnerabilities	0	7-8
Overall	3.8	~7+

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.