feat(materials): add OSSF_SCORECARD_JSON material type
Description
Adds a dedicated OSSF_SCORECARD_JSON material type so OpenSSF Scorecard results can be attested as first-class, structured evidence instead of opaque SARIF.
The crafter validates the Scorecard V2 JSON report against an embedded JSON Schema (using the existing internal/schemavalidators mechanism, consistent with the OpenAPI/AsyncAPI/CycloneDX materials), uploads the raw report to CAS, and records the Scorecard tool version and aggregate score as material annotations. It supports --no-strict-validation and participates in material auto-detection.
The embedded schema is adapted from OSSF's published json.v2.schema with details/metadata relaxed to allow null, matching real-world Scorecard output.
Closes #427
AI assistance
This change was produced with the assistance of Claude Code (Assisted-by: Claude Code).
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri