Add OpenSSF Scorecard, Dependabot and Security Policy

[carlewis]

This PR adds security tools and policy to the project:

• Enable OpenSSF Scorecard workflow, add badge to README file:
  Scorecard assesses open source projects for security risks through a series of automated checks. OpenSSF scorecard security scan will run on default branch changes, and periodically on a weekly basis. It will create a report of the project status with recommendations.
• Enable Dependabot for GitHub actions:
  Dependabot updates will happen once a month. To avoid PR noise to developers, organization level "security managers" team. will receive the notification for review. With current status, only the scorecard workflow will be affected.
• Adds the security policy file for Codeplay open source projects.

[DuncanMcBain]

Is this really needed? We're talking about a few tens of lines of shellscript and the most simple C++ I can muster (which still does something observable with SYCL). What security checks do we envisage running on this?

I expect subsequent updates to this repository only to touch the download locations for the toolkits as new versions are released. With that in mind, this seems extreme overkill.