Experimental --scoring flag for scorecards metrics

[mayaCostantini]

Related Issues and Dependencies

Related to https://github.com/thoth-station/core/issues/434 and https://github.com/thoth-station/thamos/issues/1149

This introduces a breaking change

• No

This should yield a new module release

• Yes

This Pull Request implements

Users can pass the --scoring flag to the thamos advise command to get a summary of metrics about the quality of their dependencies as described by Security Scorecards. The next step would be to aggregate metrics about packages present in Thoth's knowledge base to be able to compare the user's dependencies quality to the average dependency quality based on those metrics.

[mayaCostantini]

Related to #1148

[mayaCostantini]

@harshad16 @KPostOffice ready for review :+1:

[goern]

/lgtm

[mayaCostantini]

@harshad16 ready for review :+1:

[sesheta]

New changes are detected. LGTM label has been removed.

[goern]

/approve

[sesheta]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: goern

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/thoth-station/thamos/blob/master/OWNERS)~~ [goern] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[goern]

@mayaCostantini could you do a tiny asciinema demo for the new output?

[mayaCostantini]

@goern Sure