Improve security score/practices

[sripwoud]

See https://discord.com/channels/943612659163602974/1006997078259552346/1237782683229356173 (PSE internal discord).

Here are the scorecard results of the zk-kit repo: scorecard.txt

I don't think the goal is to get a 10/10. But there are probably some quick wins we can implement like:

• [ ] add a dependency update/scan tool bot I like using socket-security on some of my repos
• [ ] Address existing vulnerabilities
• [ ] Add a security policy file
• [ ] Improve branch protection rules
• [ ] Pin some dependencies by hash ?