Add tighter criteria for package compliance

[Paul-Reed]

This PR aims to make the following changes to the 'repository', 'bugs url' & 'bugs email' scorecard check.

1. Repository
   Currently the scorecard only checks if the 'repository' field has own property, but this PR checks that the repo url exists, and that it includes the name of the node, such as https://github.com/Paul-Reed/ 'node-red-contrib-simpletime'.
   The url format is common amongst github, bitbucket & gitlab, and verifies accordingly.

2. Bugs url
   This PR checks that the repository property exists, and that the url slug contain 'issues', which is a common format amongst github, bitbucket & gitlab, such as 'https://github.com/Paul-Reed/node-red-contrib-simpletime/ issues'

3. Bugs email
   As an alternative to 2) above, users can provide a support email address, and this PR checks that the bugs email property exists, and that it passes a basic regex to check it's format.

Scoring changes
This PR proposes that the score is not accredited unless 2 conditions are met, the first being the repository link, so that users can see the code used and assure themselves that the node is safe to use, look at what changes have/are being made, and also to contribute to it's development.
The second condition as well as the above, is that either the bugs url OR the bugs email is provided, so that the author may be contactable, and issues could be recorded.

https://docs.npmjs.com/cli/v7/configuring-npm/package-json

Although the nodes are not named here, the PR has been tested against a number of nodes where current anomalies exist, and does correct the score.
Examples include where non-standard nested properties are being used, and where the repo url is used instead of a bugs url (and issues git disabled).
It has also been tested against nodes using github, bitbucket & gitlab.

[linux-foundation-easycla]

The committers are authorized under a signed CLA.

• ✅ Paul (2b9a640)

[Paul-Reed]

No update or comment?

[Paul-Reed]

Almost 3 months old and still no response, so closing...

[knolleary]

Hi Paul, sorry it hasn't been merged.

Closing it means it never will be, which would be a shame. Once 3.0 is out the way, we can get do some housekeeping across the other parts of the project and get this sorted.

[Steve-Mcl]

@Paul-Reed Paul, any chance you can restore the branch and reopen this?

It will get reviewed but tbh it wasn't on my radar. For whatever reason I didn't spot this but now I'm aware I'll make sure I pick it up.

Please don't be afraid to give us a nudge once V3 is released.