build(deps): update ossf/scorecard-action action to v2.5.0 (#13482)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action)
| action | minor | `v2.4.4` → `v2.5.0` |

---

### Release Notes

<details>
<summary>ossf/scorecard-action</summary>

###
[`v2.5.0`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.5.0)

[Compare
Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0)

#### What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard
release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move
means for you, see the
[Scorecard v5.6.0 release
notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.6.0).

- The action's container image is built with Go 1.27.2 on a refreshed
distroless base. by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1716](https://redirect.github.com/ossf/scorecard-action/pull/1716)
- The installer (`cmd/installer`) now creates
`.github/workflows/scorecard.yml`, and still
recognizes existing `scorecards.yml` and `scorecards-analysis.yml`
workflows. by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1716](https://redirect.github.com/ossf/scorecard-action/pull/1716)
- The Scorecard version in results now always matches the Scorecard
release the action is built
with. by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1718](https://redirect.github.com/ossf/scorecard-action/pull/1718)
- The action no longer prints the GitHub token variable while validating
its options. by
[@&#8203;arpitjain099](https://redirect.github.com/arpitjain099) in
[#&#8203;1709](https://redirect.github.com/ossf/scorecard-action/pull/1709)
- `results_format` accepts `intoto`, which wraps the JSON results in an
in-toto attestation
statement. by [@&#8203;puerco](https://redirect.github.com/puerco) in
[#&#8203;1702](https://redirect.github.com/ossf/scorecard-action/pull/1702)

##### Other

- Add a daily canary against Scorecard main by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1711](https://redirect.github.com/ossf/scorecard-action/pull/1711)
- Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1714](https://redirect.github.com/ossf/scorecard-action/pull/1714)
- Run Scorecard on every merge, add a zizmor presubmit, analyze
workflows with CodeQL, and update
RELEASE.md by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1716](https://redirect.github.com/ossf/scorecard-action/pull/1716)
- Bump Scorecard to v5.6.0 by
[@&#8203;justaugustus](https://redirect.github.com/justaugustus) in
[#&#8203;1719](https://redirect.github.com/ossf/scorecard-action/pull/1719)

#### New Contributors

- [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099) made
their first contribution in
[#&#8203;1709](https://redirect.github.com/ossf/scorecard-action/pull/1709)
- [@&#8203;puerco](https://redirect.github.com/puerco) made their first
contribution in
[#&#8203;1702](https://redirect.github.com/ossf/scorecard-action/pull/1702)

**Full Changelog**:
<https://github.com/ossf/scorecard-action/compare/v2.4.4...v2.5.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yl9hY3Rpb25zIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/scorecard.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
       - name: 'Analyze'
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc  # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e  # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif