ci: add ActionScope GitHub Actions security exposure scan

[r12habh]

What

Adds a lightweight ActionScope workflow to scan GitHub Actions, Terraform, and IAM/policy JSON changes for CI/CD security exposure.

The workflow is intentionally conservative:

• runs only when workflow/action/IaC/policy files change, plus manual dispatch
• uses only contents: read
• does not call AWS APIs or require cloud credentials
• pins actions/checkout to a full commit SHA
• installs actionscope>=0.3.5,<1.0 from PyPI
• fails only on critical findings, so the current non-critical findings do not block CI

Why

I ran ActionScope locally against this repository and it found workflow-level CI/CD security signal around AWS credentials, token permissions, environments, or action supply-chain posture.

Overall Risk: 🟠 HIGH
Workflows scanned: 24
AWS credential sources: 8
Critical: 0 | High: 22 | Medium: 10 | Low: 11 | Info: 1

Because this uses --fail-on critical, this PR should add visibility without changing the current pass/fail posture.