feat: integrate Checkov for infrastructure-as-code security scanning

[MatiasOS]

Description

Integrate Checkov to scan infrastructure-as-code (IaC) files for security misconfigurations and compliance violations.

Part of the Quality Tooling Rollout (#369).

Tasks

• Set up Checkov in CI via GitHub Actions
• Scan relevant IaC/config files:
  • GitHub Actions workflows (.github/workflows/)
  • Dockerfiles (if any)
  • Cloudflare Workers / Wrangler config
  • Kubernetes manifests (if any)
• Configure .checkov.yml with project-specific skip rules
• Add PR annotations for findings
• Add Checkov badge to README

Motivation

OpenScan deploys via GitHub Actions and Cloudflare Workers. IaC misconfigurations can lead to:

• Overly permissive CI/CD permissions
• Exposed secrets in workflow definitions
• Insecure deployment configurations

Notes

• Start with informational mode, move to blocking for critical findings.
• Checkov has built-in policies for GitHub Actions, Docker, Terraform, and Kubernetes.