Disable the scorecard analysis run temporarily

[guhetier]

Description

The Scorecard analysis workflow systematically fails because of an error 401. It generates noise and makes it harder to check if something else went wrong in the CI run: the main branch always shows a failed status (https://github.com/microsoft/msquic/commits/main/).

This PR disable the run.
Fixing the permission is already tracked by #5479

Testing

CI

Documentation

N/A

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.81%. Comparing base (2c2f078) to head (e810e66).
⚠️ Report is 14 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5808      +/-   ##
==========================================
- Coverage   86.19%   84.81%   -1.39%     
==========================================
  Files          60       60              
  Lines       18729    18732       +3     
==========================================
- Hits        16144    15888     -256     
- Misses       2585     2844     +259     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mtfriesen]

This is unlikely to get traction any time soon, and doesn't provide clear value to our customers or the community, even when it works.

Let's cut the work item and delete the yaml.

[guhetier]

@copilot Remove the scorecard analysis completely, cleaning up after yourself.

[Copilot]

@guhetier I've opened a new pull request, #5842, to work on those changes. Once the pull request is ready, I'll request review from you.

[guhetier]

While trying to get a better idea whether this is a problem to remove fully, I saw the doc seems to say the token is needed only for a corner case:

https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md

For repositories that want to detect their classic Branch Protection rules

Maybe just deleting it will fix it. Otherwise, we can delete the workflow: scanning happens anyway, the action helps the maintainer of ossf to spend less resources.