TrustScope: suggested Security & Supply Chain improvements for librepods

Hi! This is a friendly, optional set of suggestions for librepods-org/librepods, generated by TrustScope from the OpenSSF Scorecard (v5.5.0).

None of these are required — they are common hardening steps that tend to raise a project's supply-chain and governance signals. Take whatever is useful and ignore the rest.

Security & Supply Chain

• Branch Protection — Add a branch-protection rule: require a pull request, a required status check, and dismiss-stale reviews. (Private repositories need a paid GitHub plan for branch protection.)
• Code Review — Require review before merge. Solo projects can satisfy this with an automated reviewer (e.g. CodeRabbit) instead of blocking human approval.
• Dependency Update Tool — Add .github/dependabot.yml — the github-actions ecosystem always, plus npm/etc. wherever a manifest exists.
• Pinned Dependencies — SHA-pin every uses: Action to a full commit SHA (with a version comment), then let Dependabot keep the pins current.
• SAST — Add a CodeQL workflow for the repository's real languages (build-mode none). Use languages: (plural) on codeql-action/init — language: is silently ignored — and job-scope security-events: write. Private repositories need GitHub Advanced Security.
• Token Permissions — Add a top-level least-privilege permissions: block to each workflow file (contents: read, with per-job write scopes only where needed). Scorecard reads the workflow file itself, not the org default setting.

Assessed via TrustScope (https://trustscope.neckarshore.ai) — an open-source trust report by Neckarshore AI. These are suggestions, not demands.

Review the repository's existing workflow files first, then check whether dependency manifests require a new .github/dependabot.yml. Apply the relevant branch-protection, review, dependency-pinning, CodeQL, and least-privilege permission suggestions, and verify that the resulting repository settings and workflows satisfy the listed security goals.