CI: add Dependabot, JDK matrix and OpenSSF Scorecard

- dependabot.yml: weekly updates for maven deps and github-actions (keeps the
  SHA-pinned actions fresh), non-major maven bumps grouped to reduce noise.
- build.yml: run the test suite across a JDK matrix (17, 21).
- scorecard.yml: OpenSSF Scorecard supply-chain analysis, results uploaded to
  code scanning. All actions pinned to commit SHAs.

Author: nilsbehlen

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  # Maven runtime/test dependencies (okhttp, gson, java-jwt, kotlin-stdlib, ...)
+  - package-ecosystem: maven
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      # Bundle non-major bumps into a single PR to cut noise.
+      maven-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Keep the SHA-pinned GitHub Actions fresh (the pins go stale otherwise).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/build.yml

@@ -14,17 +14,22 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # LTS JVMs the library is consumed on (e.g. Keycloak runs on 17/21).
+        java-version: [ '17', '21' ]
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
-      - name: Set up JDK
+      - name: Set up JDK ${{ matrix.java-version }}
         uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: ${{ matrix.java-version }}
           cache: maven
 
       # 'verify' runs the unit tests (surefire) before packaging. Tests run by

.github/workflows/scorecard.yml

@@ -0,0 +1,49 @@
+# OpenSSF Scorecard: assesses the repository's supply-chain security posture
+# (branch protection, token permissions, pinned dependencies, etc.).
+# Results appear under the repository's "Security > Code scanning" tab.
+
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [ "master" ]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      # Needed to publish results and get a badge (OpenSSF API, OIDC token).
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Keep the raw SARIF as an artifact for inspection.
+      - name: Upload artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
+        with:
+          sarif_file: results.sarif
+          category: scorecard