ci: Security Hardening

[tippmar-nr]

A few changes aimed at security hardening for this repo:

• Adds top-level default permissions to the language agent workflows. Individual jobs can still specify the permissions they need.
• Adds a dependabot.yml to enable Dependabot to open PRs for dependency updates. Note that I've included docker in the list of ecosystems; we will need to let it run once or twice to determine whether it is useful or not.
• Adds a scorecard.yml workflow to enable OpenSSF Scorecard analysis of the repo. Issues will appear under the "Security" tab on the repo and can be addressed either with a code change or manual dismissal if the issue isn't relevant.