Raise the OpenSSF Scorecard result above 5.6

[krotname]

The first Scorecard run on the public repository scored 5.6/10 (badge in both READMEs, workflow
.github/workflows/scorecard.yml).

Already satisfied: branch protection, pinned actions, dependency update tool, CI tests, CodeQL,
persist-credentials: false, security policy, license, packaging workflow.

Worth checking in the detailed report at
https://securityscorecards.dev/viewer/?uri=github.com/krotname/VsCodeMarkdownTableEditor:

• Signed-Releases — releases carry a SHA256SUMS.txt and a build provenance attestation, but
  Scorecard looks for detached signatures (cosign .sig / .asc) next to the artifact.
• CII-Best-Practices — the JetBrains edition has a bestpractices.dev badge; this repository has none.
• Fuzzing — no fuzz target for src/core.ts, which is a pure text-in/text-out function and would
  suit one well.
• Token-Permissions / Dangerous-Workflow — confirm nothing regressed after the publish workflow
  was added.

Not urgent: 5.6 is a normal starting point for a freshly published repository. Recorded so the number
is a tracked decision rather than an oversight.