Add OSSF Scorecard callee workflow

[ehaldane-digicatapult]

Pull Request

Checklist

• Have you read Digital Catapult's Code of Conduct?
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.

PR Type

• Feature
• Documentation Update

Linked tickets

ENG-312

High level description

This request is to add a callee workflow for OpenSSF Scorecard, to generate appraisals against a repository and optionally publish the results (with a badge). This new workflow splits into two parts, the first using the upstream ossf/scorecard-action, which isn't customisable and uses all checks and policies by default. Conversely, the second part is customisable, taking an input that defines dynamically which policies are in scope and which checks actually run. Publishing the customised results isn't feasible with the CLI alone, so I've skipped that. Results are uploaded as artefacts or to the Advanced Security dashbaord in either SARIF or JSON format.