Workflow verification doesn't support re-usable workflows

[spencerschrock]

The scorecard-webapp doesn't support repos which use a reusable workflow from another repository.

When Scorecard action POSTs the JSON to the webapp, the webapp tries to download and verify the workflow, but the logic currently assumes the workflow always comes from the same repo. The API used to download the workflow file then
fails with a 404 error, leading to a vague 500 error on the original POST from action to webapp:

error processing signature: http response 500, status: 500 Internal Server Error, error: {"code":500,"message":"something went wrong and we are looking into it."}

https://github.com/gabibguti/helm-sigstore/actions/runs/3697754335/jobs/6300965360#step:4:1207

Triaging the bug:

// from the sigstore/fulcio x509 cert (which also has "https://github.com" out front but we discard earlier
workflowRef := "/gabibguti/community/.github/workflows/reusable-scorecard.yml@refs/heads/main"
// from the fact that scorecard action hits "projects/github.com/gabibguti/helm-sigstore"
repoFullName := "gabibguti/helm-sigstore"

// ind is -1 here and isn't checked. which leads to the gibberish
ind := strings.Index(workflowRef, repoFullName) + len(repoFullName) + 1

workflowPath := workflowRef[ind:]
// note: another index call whose value isn't checked
workflowPath = workflowPath[:strings.Index(workflowPath, "@")]

// workflow path is now "ithub/workflows/reusable-scorecard.yml"

which effective tries to fetch a non-existant file: gabibguti/helm-sigstore/contents/ithub/workflows/reusable-scorecard.yml

// org = "gabibguti"
// repo = "helm-sigstore"
// info.workflowPath = "ithub/workflows/reusable-scorecard.yml"
client.Repositories.GetContents(ctx, org, repo, info.workflowPath, opts)

[spencerschrock]

Testing this behavior with the staging API was a success:
https://github.com/spencerschrock/reusable-workflow-caller/actions/runs/3790307154/jobs/6444829461

Going to cut a release to get it into prod.

[spencerschrock]

@gabibguti the fix is now deployed in prod. Feel free to re-open if you're still having issues.