Security hardening controls for OpenSSF Scorecard

[Scetrov]

Summary

Implements security hardening controls to address OpenSSF Scorecard findings:

Dependency Reproducibility

• Pin .NET runtime base image to digest (resolves Scorecard finding fix(): restore and build before publish #4)
• Enable NuGet lock file generation for all solution projects
• Enforce locked restore mode in CI and validation script

Parser Robustness (SharpFuzz)

• Add dedicated fuzzing project with SharpFuzz 2.3.0
• Implement targets for Sui GraphQL, Move JSON, ResIndex, Pickle (local unpickler), World API
• Use production deserialization paths through real client code
• Configure corpus replay in main workflow
• Add bounded fuzzing workflow for scheduled execution
• Isolate filesystem access for ResIndex target
• Classify expected parse rejections in each harness

Repository Governance

• Require strict up-to-date required status checks
• Disable ineffective code-owner review requirement
• Document solo-maintainer residual risk with exit criteria
• Update security policy with direct private vulnerability reporting link
• Publish maintainer-approved acknowledgement, update, and coordinated-disclosure targets

Verification

• Add remediation baseline evidence document capturing current Scorecard and ruleset state
• Capture approved base image digest and platform support
• Record approved fuzzing limits and vulnerability-reporting targets

Testing

• All fuzz targets pass deterministic corpus replay locally
• Locked restore verified for all eight solution projects
• Deliberate stale lock file fails pre-build as expected
• Docker image digest locally verified for both target platforms

Notes

• Tasks 2.4, 3.2, 4.9, 5.5, 6.x require CI execution or external admin actions and remain open for follow-up.