Add OpenSSF Best Practices (CII) badge

## Summary

Register the project with the [OpenSSF Best Practices Program](https://www.bestpractices.dev) (formerly the Linux Foundation CII Best Practices badge) and add the resulting badge to the README.

## What is it?

The OpenSSF Best Practices badge is a widely-recognised trust signal for open-source projects. A maintainer completes a self-attestation questionnaire covering:

- Project documentation and website
- Change control and version control practices
- Reporting and handling vulnerabilities
- Quality: working build system, automated test suite, test coverage
- Security: use of good cryptographic practices, vulnerability scanning

Badge levels: **Passing → Silver → Gold**

## Why add it?

As a security-focused tool (SBOM validation, CycloneDX/SPDX), `sbom-utility` should itself demonstrate strong security hygiene. The badge gives users and integrators confidence that the project follows recognised best practices for secure, reliable OSS development.

## Prerequisites for Passing level

Most criteria are already met. Items to confirm or add:

- [ ] Register project at https://www.bestpractices.dev and obtain a project ID
- [ ] Add a `SECURITY.md` documenting the vulnerability disclosure / reporting process (required for Passing)
- [ ] Confirm the automated test suite is documented in the README
- [ ] Confirm the project has a documented contribution process (`CONTRIBUTING.md` or equivalent)
- [ ] Add badge to README once registered:

```markdown
[](https://www.bestpractices.dev/projects/)
```

## References

- OpenSSF Best Practices: https://www.bestpractices.dev
- Criteria checklist: https://www.bestpractices.dev/en/criteria
- Example `SECURITY.md` (GitHub template): https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository

Start with README.md, the OpenSSF Best Practices criteria checklist, and any existing CONTRIBUTING.md or security guidance. Register the project, document vulnerability reporting in SECURITY.md, confirm the contribution and test-suite documentation, and add the resulting badge to README.md; done means the Passing-level prerequisites are addressed and the badge links to the project page.

Written by the indexing model from the issue text.