[CI:DOCS] README.md: add openssf passing badge

[lsm5]

What type of PR is this?

/kind documentation

What this PR does / why we need it:

Adds openssf passing badge to satisfy CNCF requirement

How to verify it

See badge on README.md at https://github.com/lsm5/buildah/tree/openssf-passing

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

Feel free to check out https://www.bestpractices.dev/en/projects/10579 before LGTM.

Does this PR introduce a user-facing change?

None

[packit-as-a-service]

Ephemeral COPR build failed. @containers/packit-build please check.

[lsm5]

@containers/buildah-maintainers PTAL

I prefer we not merge this until lgtm'd by @mtrmac at least.

[lsm5]

The security evaluation skips stuff inside vendor/ as in podman and skopeo

[mtrmac]

Crypto uses (outside vendor) LGTM. I didn’t re-check all of the badge requirements.

I have filed #6182 to track a cleanup. That feature is undocumented and, AFAICT, entirely unsupported for use by external users, so I don’t think it has to be listed in the badge evaluation — but I want to have a written record for why it is out of scope.

[lsm5]

@containers/buildah-maintainers PTAL

[lsm5]

@containers/buildah-maintainers mergeme

[giuseppe]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, lsm5

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [giuseppe,lsm5]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

/lgtm