Velero has no published OpenSSF Scorecard results, so the Scorecard
badge does not resolve and CLOMonitor flags the openssf_scorecard_badge
check as missing.
Add the ossf/scorecard-action workflow (SHA-pinned, least-privilege
permissions, publish_results enabled) running weekly and on push to
main. Once it runs post-merge, results publish to the OpenSSF API and
the README badge resolves. This also surfaces the project's security
posture (currently 6.2/10) to guide further hardening.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
