Add [OpenSSF scorecard](https://deps.dev/project/github/adriankumpf%2Fteslamate) - [x] link SECURITY.md - [ ] decide on untrusted code checkout in ghcr_build.yml - [x] implement SAST (we do have static code analysis run on each PR (dialyxir, see https://github.com/teslamate-org/teslamate/blob/9adbdbce32ef7200316561340b59402655598d7f/.github/workflows/elixir_dep_verification_and_static_analysis.yml#L70), but OpenSSF does not detect it)
