Improve OSSF Scorecard Score

[zachleat]

Via https://app.opensauced.pizza/s/11ty/eleventy?hideBots=false

Started at 3.8 as of now we’ve improved to 6.2.

https://scorecard.dev/viewer/?uri=github.com/11ty/eleventy

Still working on it!

[zachleat]

#2110 #3100 relates to this https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies

[zachleat]

Up to 7.8: https://scorecard.dev/viewer/?uri=github.com/11ty/eleventy

[zachleat]

• Our Code-Review goose-egg score will improve over time as pull requests are forced through this audit-approved workflow (though practically speaking the workflow will be no different, I just have to push more buttons)
• We also have a small deduction for an old PR that slipped through without running the test suite, those will improve over time as well
• It’s unlikely I’ll add Fuzzing here, so that one will probably stay at a 0.
• I did attempt to get the CII-Best-Practices badge but the site was sufficiently sketchy and didn’t let me sign up without using GitHub so that one will remain a 0 too.