ci: add SCA, Scorecard and malware scan workflows - #976

Changes

• Added .github/workflows/sca.yml, which runs the org SCA scan on pushes and pull requests to 6.x, using the reusable workflow from auth0/devsecops-tooling pinned to a commit SHA
• Added .github/workflows/scorecard.yml, which runs OpenSSF Scorecard analysis on pushes and pull requests to 6.x, with all action refs pinned to commit SHAs
• Added .github/workflows/rl.yml, a reusable malware scan workflow mirrored from 5.x. Nothing calls it yet and its build step is still the placeholder, so it does nothing until it is wired into the release workflow
• Mirrors the workflows added on 5.x in chore(security): add SCA scan workflow #973, chore(security): add OpenSSF Scorecard workflow #974 and chore(security): add ReversingLabs malware scan workflow #975

References

Related: #973, #974, #975

Testing

sca.yml and scorecard.yml run on this PR, and the results will be confirmed before merging. rl.yml is not triggered until a workflow calls it.

Checklist

• The correct base branch is being used, if not the default branch