feat: add gitlab openssf scorecards

[adam-moss]

Changes

Adds OpenSSF scorecard reporting for GitLab.

Context

Adding following testing as part of #25125 (reply in thread)

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[CLAassistant]

All committers have signed the CLA.

[adam-moss]

Tested against a private repository. Seems the OpenSSF api has a challenge with /group/subgroup/project urls. I wonder if there is something nicer we could do rather than having a broken image link?

Example:
https://gitlab.com/gitlab-org/ruby/gems/gitlab-triage
https://api.securityscorecards.dev/projects/gitlab.com/gitlab-org/ruby/gems/gitlab-triage/badge

[secustor]

Looks like they do not support subrepos

https://github.com/ossf/scorecard-webapp/blob/f28966e9510138cce79c35d9d3e7a431276e8386/app/server/badge.go#L44

[adam-moss]

Indeed, I have raised ossf/scorecard-webapp#511

[rarkins]

What's the next step here?

[secustor]

It's not actionable by us right now and blocked by OSSF scorecards API server implementation

[rarkins]

OK, please feel free to reopen this as soon as it's actionable. We have 60+ open PRs right now so would like to close anything non-actionable and stalled.