ci: scan pull requests for credentials and injection with ThreatCrush

[ralyodio]

Adds one workflow. On each pull request it scans the checked-out repository for
hardcoded credentials, injection, SSRF and unsafe deserialisation, and writes
findings to the Security tab and a comment.

• .github/workflows/threatcrush-scan.yml
• .github/scripts/threatcrush-to-sarif.py — SARIF shim for older CLI versions

Report-only. failOn is empty, so findings never fail the build. An install
or scan failure does fail the job: a scanner that reports clean when it did not
run is worse than no scanner.

Scope: it scans the whole checked-out repository, not only the diff.

Supply chain. Pinned to @profullstack/threatcrush@0.11.1; the tarball is hashed and checked against
a value in the workflow before install (npm view it yourself), installed with
--ignore-scripts, actions pinned to commit SHAs, and it runs on pull_request
rather than pull_request_target.

Asked first in #952.

Disclosure: I maintain ThreatCrush;
MIT and free. Written with AI assistance. Closing this is a fine answer and I
will not send another.