Add CII shield and harden CodeQL

[felddy]

🗣 Description

• Add the CII Best Practices shield to the README.
• Harden the CodeQL workflow.

💭 Motivation and Context

See: https://github.com/ossf/scorecard

CodeQL softness was one of the findings of the new workflow.

This is the way.

🧪 Testing

CI, GitHub actions

✅ Checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow project standards.
• All relevant repo and/or project documentation has been updated to reflect
  the changes in this PR.
• Tests have been added to cover the changes in this PR.
• All new and existing tests pass.