feat(supply-chain-audit): add OpenSSF Scorecard collect, analyze, and workflow

[sudhirverma]

Summary

• Add OpenSSF Scorecard to the supply-chain audit pipeline: detect workflows, fetch published API scores, and fall back to a pinned local Scorecard CLI when the API has no result.
• Surface Scorecard posture in the HTML/PDF report (workflow presence, score source, weak critical checks) and emit findings for incomplete workflows, unpublished results, weak critical checks, and low published API aggregates.
• Dogfood Scorecard on this repo via .github/workflows/scorecard.yml (push to main, weekly schedule, publish + SARIF upload), adapted from redhat-developer/abbenay#57.

Changes

• collect.py: Scorecard workflow discovery; OpenSSF API fetch; auto-bootstrap pinned CLI (v5.5.0) into .supply-chain-audit/bin/; CLI runs the full suite except Vulnerabilities (slow OSV walk — dependency CVEs remain covered by the existing OSV.dev pass); prefer managed binary over PATH; re-probe API for CLI-only cache entries without wiping the CLI snapshot; --skip-scorecard-cli / --refresh-scorecard.
• analyze.py: 14th detection pass for Scorecard gaps; aggregate risk thresholds apply to API scores only (CLI aggregates are not comparable).
• report.py + dashboard template: Scorecard section/table; shared thresholds via audit_models.py.
• cache_utils.py: Scorecard cache read/write helpers.
• Docs: SKILL.md and detection-patterns.md updated for Scorecard behavior (missing workflows are table-only, not findings).

Quality of life

• Skill docs clarify CLI auto-bootstrap (no manual Scorecard install) and the intentional Vulnerabilities exclusion.
• Detection-pattern reference documents API vs CLI score semantics for guardians.

Test plan

• tox -e lint passes
• tox -e py passes
• Docs updated (SKILL.md, detection-patterns.md)
• After merge: confirm Scorecard workflow runs on main and publishes to OpenSSF / code scanning
• Optional: re-run /td-supply-chain-audit on a short window and verify Scorecard table + findings

Made with Cursor