ci: implement OSSF scorecard and Dependabot

[alessfg]

Proposed changes

• Implement the OSSF scorecard GitHub Action.
• Implement Dependabot.
• Tweak the main GitHub Actions workflow to target main instead of master and use specific GitHub Action release SHAs instead of the generic version tag (this will help achieve a higher OSSF scorecard score).

Checklist

Before creating a PR, run through this checklist and mark each as complete:

• [x] I have read the contributing guidelines.
• [x] If applicable, I have added tests that prove my fix is effective or that my feature works.
• [x] If applicable, I have checked that any relevant tests pass after adding my changes.
• [x] I have updated any relevant documentation (e.g. README.md).