docs: disable Code Security scanning on private frmscoe rules

[KyleVorster7]

Summary

• Document the decision in the README: no dedicated billable Code Security scanning (njsscan / Scorecard) on private frmscoe rule repos.
• Keep that scanning on public tazama-lf/rule-901 and rule-902; fixes propagate through the normal central-workflow path.
• Stop syncing njsscan.yml and scorecard.yml to the 33 private rules, and delete leftovers on sync.

Why

SARIF upload on private repos needs paid GitHub Code Security. Enablement is locked on these private rules, so those jobs fail without a usable dashboard. Public reference rules get Code Security for free.

This follows the agreed approach: document in frmscoe/workflows, then turn off scanning on the private repos.

Test plan

• README decision section is clear
• After merge, sync-workflows no longer copies njsscan/scorecard
• Sync removes leftover njsscan.yml / scorecard.yml from a sample rule repo