Change how scorecard action is executed

[claudioandre-br]

Describe your changes

Ensure the job is only run in the project's original repository.

Use a new approach to control and filter when the action is executed:

1. only in the original repository;
2. only targeting the main branch.

Plus:

1. or in a scheduled execution;
2. or in a push for main.

In fact, all actions will be changed if this works properly.

Checklist before requesting a review

• [x] I checked that all workflows return a success.
• [x] I have performed a self-review of my code.
• [ ] I have added tests that prove my fix is effective or that my feature works.
• [x] I followed the [Conventional Commit spec][commitMessage].

Maintainer tasks

• [x] Label as either: bug, ci, docker, documentation, enhancement.
• [x] Sign unsigned commits.

[commitMessage]: https://github.com/openwall/john-packages/blob/main/docs/commit-message.md#how-a-commit-message-should-be

[claudioandre-br]

bot: MERGE status

[github-actions[bot]]

🤖: status
- reviewDecision: APPROVED ✔
- mergeStateStatus: BLOCKED ❌

[claudioandre-br]

The bot itself can't change an action recipe. Tomorrow we'll see if it complains about workflow dependencies