feat: run scorecard only once

[laurentsimon]

The Action runs scorecard twice: once for the SARIF results, and once to upload the results to the API server. This increases rate limits and is also slower.

We need to run scorecard once only, then:

1. filter out the results depending on trigger type (PR vs not PR), and generate the SARIF output
2. Use all the results and generate the JSON result to upload to the API server

/cc @naveensrinivasan @azeemsgoogle