Tracking OSSF Scorecard improvements

[trask]

https://securityscorecards.dev/viewer/?uri=github.com/open-telemetry/opentelemetry-java-instrumentation

[trask]

I don't understand why our "Token-Permissions" score is still 0/10. This is my latest attempt: #13156

UPDATE: that fixed the Token-Permissions score, now 10/10

[trask]

I answered questions for OpenSSF Best Practices program, which should bump our "CII-Best-Practices" score from 0/10 to 5/10.

[trask]

Next: convert from classic "branch protections" to "repository rules" as part of https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional

UPDATE: I've enabled a ruleset on main to potentially replace the branch protection on main. I've set the ruleset enforcement to "Evaluate" which I think means it shouldn't prevent anything from happening, but we might(?) see it referenced in PRs, not sure...