ci: migrate OSSF Scorecard to shared workflow

[opentelemetrybot]

Migrate OSSF Scorecard to the shared workflow. This limits code scanning alerts from Scorecard to BinaryArtifactsID, DangerousWorkflowID, PinnedDependenciesID, and TokenPermissionsID. See open-telemetry/sig-security#309 for details.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Migrates the OSSF Scorecard workflow to use the centralized open-telemetry/shared-workflows reusable workflow, while tightening default token permissions.

Changes:

• Replaces in-repo Scorecard steps with a call to the shared scorecard.yml reusable workflow.
• Sets workflow-level permissions: {} and explicitly grants only the job permissions needed for checkout, OIDC publish, and SARIF upload.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (b9c9963) to head (413c5ad).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #2045      +/-   ##
============================================
- Coverage     68.14%   68.03%   -0.12%     
  Complexity     3083     3083              
============================================
  Files           459      459              
  Lines          9031     9031              
============================================
- Hits           6154     6144      -10     
- Misses         2877     2887      +10     

Flag	Coverage Δ
8.1	67.78% <ø> (+0.01%)	⬆️
8.2	67.98% <ø> (-0.07%)	⬇️
8.3	68.00% <ø> (+0.05%)	⬆️
8.4	67.96% <ø> (-0.03%)	⬇️
8.5	67.96% <ø> (+0.01%)	⬆️
8.6	67.98% <ø> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 7 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b9c9963...413c5ad. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[trask]

@open-telemetry/php-approvers please review, thanks!