feat: add OSPS baseline maturity config

[slegarraga]

Closes #5

Summary

Adds Baseline Maturity Level 1 configuration for gemara-react:

• security-insights.yml following the gemara repository pattern, with repository URLs adapted to gemara-react;
• .github/workflows/baseline-scanner.yml running the weekly OSPS baseline scan and allowing manual dispatch.

Verification

• Both YAML files parse successfully.
• No secrets or private values are included; the workflow reads only the existing GEMARA_AUTOMATION_CLIENT_ID and GEMARA_AUTOMATION_PRIVATE_KEY repository secrets.

Config-only change.

Signed off with DCO.