repo security setup

[stevemcghee]

via https://g3doc.corp.google.com/company/teams/opensource/github/security-recommendations.md?cl=head

• https://github.com/ossf/scorecard-action#installation + https://github.com/ossf/allstar#installation-options
• enable 2FA (gnubby not SMS)
• https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates
• https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository#setting-up-code-scanning-using-actions
• https://docs.github.com/en/organizations/organizing-members-into-teams/managing-code-review-settings-for-your-team
• https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
• (it keeps going)