Use annotations to suppress false-positive security warnings

[bmuenzenmeyer]

https://github.com/ossf/scorecard/blob/main/config/README.md#annotating-your-project

for example, in a .github/scorecard.yml

annotations:
  - checks:
      - dangerous-workflow
    reasons:
      - reason: remediated # the workflow is dangerous but only run under maintainers verification and approval

Unsure if non-contributors can see these - so not labeling them good first issue for now

[ovflowd]

Unsure if non-contributors can see these - so not labeling them good first issue for now

What do you mean by that? 🤔

[bmuenzenmeyer]

What do you mean by that? 🤔

I don't know if just anyone can see this tab

closed via #6979