ci: add Plumber workflow security check

[Totara-thib]

Companion to #13889, merge that one first: the check added here flags the unpinned actions and the missing permission scopes until the hardening lands, then it goes green.

This adds Plumber to CI, the tool I used to find those issues in the first place. It scans the workflows on each push to main and on each PR, and fails when something regresses: an unpinned action, a job without a permissions block, a known vulnerable action version, that kind of thing. The gate passes at 85 of 100 points, so one small finding does not block your PRs.

• plumber.yml: pinned by sha, minimal permissions, findings go to the Security tab as SARIF (skipped on PRs from forks, the report stays as a workflow artifact there).
• .plumber.yaml: a small overlay that inherits the tool's built-in baseline; the only thing written is what differs for this repo, the release and site deploy actions already in use are trusted on top of the curated default source list. Everything else, including new controls in future releases, follows the defaults automatically.
• README.md: one line, the score badge next to the npm ones.

Score badge

I enabled score-push on the action. It works like OpenSSF Scorecard's published results: every run, on any branch, publishes the score to score.getplumber.io, and that feeds the badge in the README. Scores are public and the badge always shows the state of main. A failed publish never fails your CI. Until the first run the badge reads UNKNOWN in gray, then it flips to the grade. If you would rather not have it, drop the README line and the score-push input, the rest works the same.

With the hardening in, this runs green with a score of A. Set soft-fail: true if you prefer report only, without gating PRs.

To be fully transparent: I work on Plumber. If you do not want the tool in your CI, no hard feelings, say so and I close this PR, the hardening PR stands on its own.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.35%. Comparing base (ec5b45b) to head (64d993b).
⚠️ Report is 281 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #13890      +/-   ##
==========================================
- Coverage   89.60%   89.35%   -0.25%     
==========================================
  Files         257      257              
  Lines        7013     6698     -315     
  Branches     1736     1675      -61     
==========================================
- Hits         6284     5985     -299     
+ Misses        384      378       -6     
+ Partials      345      335      -10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.