Add CodeQL SAST, a cargo-fuzz harness, and scorecard docs

[axellpadilla]

Summary

Raises the project's OpenSSF Scorecard score (currently 6.2) by addressing the two checks that are fixable in code, and documents the rest. No production src/ changes.

Why

Scorecard flags two 0-score checks that a code change can actually resolve:

• SAST (0) — no static-analysis tool runs on commits.
• Fuzzing (0) — no fuzz harness exists for the primary bypass surface.

The remaining low checks (Code-Review, Branch-Protection, Maintained, Contributors, Signed-Releases, CII-Best-Practices) need repo settings, time, or process — not code — so they're documented rather than claimed.

What changed

• .github/workflows/codeql.yml — CodeQL analysis (languages: rust) on push, PR, and a weekly schedule. SHA-pinned, least-privilege permissions.
• fuzz/ — an isolated cargo-fuzz / libfuzzer-sys crate with two targets:
  • path_normalizer — fuzzes the request-path decision surface (percent-decoding, dot-segments, API-version strip, pattern matching).
  • policy_parse — fuzzes TOML policy parsing and rule application.
  • Isolated via its own [workspace] and Cargo.lock, so the production dependency tree (<130 crates) and binary budget (<8 MB) are untouched.
• .github/workflows/fuzz.yml — a scheduled deep-fuzz job (-max_total_time=300) plus a light PR regression smoke job (-max_total_time=20), both using the debug profile.
• README.md / STATUS.md — a ## Scorecard section documenting what's addressed and what the remaining checks require.
• SECURITY.md — removed three stale "Known Gaps" that are already implemented; points at STATUS.md.
• CONTRIBUTING.md — added (workflow, required checks, coding standards).

Scorecard impact

Check	Before	After
SAST	0	10
Fuzzing	0	10

Expected aggregate: ~6.2 → ~7.3–7.6 (both checks are high-weight). The score only refreshes after this merges to main and the scorecard action re-runs.

Verification

• Root cargo build --locked and cargo test --all-targets --locked green; root Cargo.lock unchanged.
• Fuzz targets compile (cargo +nightly check --manifest-path fuzz/Cargo.toml) and smoke-run with no crashes (-runs=2000).
• New workflow YAML parse-checked; all actions SHA-pinned; least-privilege permissions.

Caveats

• Release/ASan fuzz build hits a rustc codegen ICE inside tokio under -C passes=sancov-module on current nightly, so both fuzz jobs use the debug profile (-D), which builds and runs cleanly. Worth revisiting when nightly stabilizes.
• Getting this PR reviewed before merge also lifts the scorecard's Code-Review check.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.