ci: scan pull requests for credentials and injection with ThreatCrush

[ralyodio]

Adds one workflow. On each pull request it scans the checked-out repository for
hardcoded credentials, injection, SSRF and unsafe deserialisation, and writes
findings to the Security tab and a comment.

• .github/workflows/threatcrush-scan.yml
• .github/scripts/threatcrush-to-sarif.py — SARIF shim for older CLI versions

Report-only. failOn is empty, so findings never fail the build. An install
or scan failure does fail the job: a scanner that reports clean when it did not
run is worse than no scanner.

Scope: it scans the whole checked-out repository, not only the diff.

Supply chain. Pinned to @profullstack/threatcrush@0.11.1; the tarball is hashed and checked against
a value in the workflow before install (npm view it yourself), installed with
--ignore-scripts, actions pinned to commit SHAs, and it runs on pull_request
rather than pull_request_target.

Asked first in #278.

Disclosure: I maintain ThreatCrush;
MIT and free. Written with AI assistance. Closing this is a fine answer and I
will not send another.

[vercel]

@ralyodio is attempting to deploy a commit to the itsmeakhil's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.