use Scorecard library entrypoint instead of Cobra hooking

[spencerschrock]

Scorecard V5 released a new entrypoint, so make use of it instead of
hooking into the underlying Cobra CLI. This gives us more flexibility
when running Scorecard, such as writing the result to multiple formats.

The code got moved around a lot, my hope is it's organized more
clearly now, but I'll try to summarize it for the sake of the reviewer.

entrypoint/entrypoint.go used to do several things

1. Read the Scorecard Action options, which now takes place in our main.go
   

   scorecard-action/main.go

   Lines 35 to 39 in 486e8de

   	opts, err := getOpts()
   	if err != nil {
   	log.Fatal(err)
   	}
   	opts.Print()

2. All sorts of pre/post hooks to redirect output to both stdout and a result file. Which is done explicitly in a new format helper function.
   

   scorecard-action/internal/scorecard/format.go

   Lines 47 to 53 in 486e8de

   	// write results to both stdout and result file
   	resultFile, err := os.Create(opts.GithubWorkspace + opts.InputResultsFile)
   	if err != nil {
   	return fmt.Errorf("creating result file: %w", err)
   	}
   	defer resultFile.Close()
   	writer := io.MultiWriter(resultFile, os.Stdout)

signing/signing.go re-ran scorecard via GetJSONScorecardResults, which is now a simple extra formatting call.

scorecard-action/main.go

Lines 54 to 58 in 486e8de

	// if we don't already have the results as JSON, generate them
	if opts.InputResultsFormat != "json" {
	opts.InputResultsFormat = "json"
	opts.InputResultsFile = "results.json"
	err = scorecard.Format(&result, opts)

In terms of testing, separating the format code makes it more testable! But the rest of it is very hard to unit test. I'll look into testing the rest of it.

Fixes #1071

[spencerschrock]

In terms of testing, separating the format code makes it more testable! But the rest of it is very hard to unit test. I'll look into testing the rest of it.

Testing the Dockerfile locally, the JSON output is identical (using scdiff to compare), and the SARIF matches. The nightly e2e tests would test for fatal errors after merge as well.

But there aren't any great e2e tests currently setup before merge.

[justaugustus]

Minor nits.
Looks much cleaner, @spencerschrock!!

[justaugustus]

Approving with code suggestions applied from #1423 (review).