Improve security score/practices

[sripwoud]

See https://discord.com/channels/943612659163602974/1006997078259552346/1237782683229356173 (PSE internal discord).

Here are the scorecard results of the zk-kit repo:
scorecard.txt

I don't think the goal is to get a 10/10.
But there are probably some quick wins we can implement like:

• add a dependency update/scan tool bot
  I like using socket-security on some of my repos
• Address existing vulnerabilities
• Add a security policy file
• Improve branch protection rules
• Pin some dependencies by hash ?