[Security] Apply for OpenSSF Best Practices badge

## Issue
OpenSSF Scorecard identified no effort to earn an OpenSSF Best Practices badge, scoring 0/10.

## Risk Level
**Low** - The badge itself doesn't directly improve security, but achieving it ensures adherence to industry best practices.

## Current State
- No OpenSSF Best Practices badge application
- Project may already meet many criteria but lacks formal recognition
- Missing community signal of security commitment

## Recommendation
Apply for and earn the OpenSSF Best Practices badge (formerly CII Best Practices).

### What is the Badge?
The OpenSSF Best Practices badge demonstrates that the project follows security and quality best practices:
- Passing level: Basic open-source best practices
- Silver level: More rigorous requirements
- Gold level: Exemplary practices

### Badge Criteria Categories:
1. **Basics** - Documentation, licensing, version control
2. **Change Control** - Public version control, unique version numbers
3. **Reporting** - Bug reporting process, vulnerability disclosure
4. **Quality** - Testing, code review, static analysis
5. **Security** - Vulnerability response, secure development practices
6. **Analysis** - SAST tools, dynamic analysis

### Why Apply?
- **Visibility**: Shows commitment to security and quality
- **Improvement**: Identifies gaps in current practices
- **Trust**: Helps users/contributors assess project maturity
- **Alignment**: Many criteria likely already met by tar-diff

## Steps to Implement
1. Review badge criteria at https://bestpractices.coreinfrastructure.org/
2. Create a project application
3. Complete self-assessment questionnaire
4. Address any gaps identified during assessment
5. Submit for badge approval
6. Add badge to README.md once earned

## Likely Status
Based on OpenSSF Scorecard results, tar-diff likely already meets many criteria:
- ✅ Has public version control (GitHub)
- ✅ Has a license (Apache 2.0)
- ✅ Has CI/CD with tests
- ✅ Uses SAST tools (CodeQL)
- ✅ Has vulnerability scanning (govulncheck)
- ✅ Has security policy (SECURITY.md)
- ✅ Has automated releases

Missing areas to address:
- ⚠️ Fuzzing (see containers/tar-diff#87)
- ⚠️ Signed releases (see containers/tar-diff#88)
- ⚠️ May need to document some existing practices

## Timeline
- Initial application: ~1-2 hours
- Addressing gaps: Varies (some already tracked in other issues)
- Badge approval: Typically fast once criteria met

## References
- [OpenSSF Best Practices Badge](https://bestpractices.coreinfrastructure.org/)
- [Badge Criteria](https://bestpractices.coreinfrastructure.org/en/criteria/0)
- [OpenSSF Scorecard - CII Best Practices](https://github.com/ossf/scorecard/blob/main/docs/checks.md#cii-best-practices)
- OpenSSF Scorecard Score: 0/10

## Related
Part of OpenSSF Scorecard evaluation THEEDGE-4717 (overall score: 6.8/10)