ci: scan pull requests for credentials and injection with ThreatCrush

[ralyodio]

Adds a pull-request workflow that scans the diff for hardcoded credentials,
injection, SSRF and unsafe deserialisation. Results go to the Security tab as
SARIF and to a comment on the pull request.

What it does on this repository

@profullstack/threatcrush@0.11.0 scan .
100 files in 1.3s — 0 finding(s)

Nothing flagged. That is the whole report — the comment on a pull request
would say the same.

Opened alongside the question in
#1, which is the place to say no or ask for
changes. This is only the diff, so it is there to read rather than imagine —
closing either one is a fine answer.

This is not a CodeQL replacement, and it is worth saying where it differs.
CodeQL does semantic dataflow analysis and is better at it than this is — a
repository already running it is not missing much by closing this. Two gaps it
does fill:

• Code scanning and secret scanning are free on public repositories, but need
  paid GitHub Code Security / Secret Protection on private ones. This is MIT and
  free on both, so the same gate can run across a mixed set of repositories.
• CodeQL analyses a fixed set of languages, and among compiled ones it analyses
  only the language with the most source files unless it's explicitly configured
  otherwise. In a polyglot repository the rest goes unscanned by default; this
  reads every file it is pointed at.

It is additive and report-only, so running both costs a few CI minutes and
changes nothing else.

It is report-only. failOn is empty, so it annotates and never fails a build.
A repository with pre-existing findings should get a report on its first install,
not a blocked pull request — a gate that fires on everything gets switched off
within a day. Tighten it to critical,high in the workflow once any backlog is
triaged.

• .github/workflows/threatcrush-scan.yml — the workflow
• .github/scripts/threatcrush-to-sarif.py — a compatibility shim for CLI versions
  older than native SARIF output; unused once the installed CLI can emit it itself

Permissions are least-privilege (contents: read, pull-requests: write,
security-events: write). It runs on pull_request, not pull_request_target,
so contributor code never executes with your secrets in scope. The SARIF upload
is continue-on-error and degrades quietly where code scanning is unavailable.

The CLI is pinned to @profullstack/threatcrush@0.11.0 and installed with
--ignore-scripts, and checkout runs with persist-credentials: false. A
scanner that installs a floating version, runs its dependencies' lifecycle
scripts and leaves a token in .git/config is asking you to trust more than it
is worth, and none of that is needed to read a diff. Bump the pin whenever you
like — nothing here updates itself.

Disclosure: I maintain ThreatCrush.
It is free and MIT, and the workflow installs it from npm — nothing here phones
home. If this is not something you want, closing it is the right answer, and I
will not send another.