Feature: Allow "incomplete" checks for --local repos

[pnacht]

Is your feature request related to a problem? Please describe.
Running scorecard with --local only allows it to run 6 checks. Of the 12 that aren't run, I propose that 6 be allowed to run, even if the results may be incomplete when compared with the upstream:

• Fuzzing
• License
• Maintained
• Packaging
• SAST
• Security-Policy

Describe the solution you'd like

• Fuzzing only requires a non-local repo for OSS-Fuzz, all other fuzzers are detected using files in the repository itself. With --local, we simply don't look for OSS-Fuzz.
• License tries to use the platform's API, but it already has fallback methods to scan the repository itself. With --local, we simply use the fallbacks.
• Maintained can score a --local repo using just the commit activity: use git log to detect the frequency of commits and use the date of the root commit to determine whether the repo is 90+ days old.
• Packaging currently looks for release workflows and then checks to see if they've ever passed. With --local, it could skip that later step.
• SAST looks for workflows with CodeQL or SonarCloud and sees if they're run on PRs (or something like that?). With --local, it could simply reward for having a SAST workflow.
• Security-Policy looks for a policy in the repo or the org's .github repo. With --local, it could just look in the repo.

In all of these cases, Scorecard should log that the results are potentially incomplete/unrepresentative of the upstream repository.

[spencerschrock]

We do this in other places already ( see #3756 and #3415):

scorecard/checks/raw/dependency_update_tool.go

Lines 44 to 54 in 83ff808

	commits, err := c.SearchCommits(clients.SearchCommitsOptions{Author: "dependabot[bot]"})
	if err != nil {
	// TODO https://github.com/ossf/scorecard/issues/1709
	// some repo clients (e.g. local) don't currently have the ability to search commits,
	// but some data is better than none.
	if errors.Is(err, clients.ErrUnsupportedFeature) {
	return checker.DependencyUpdateToolData{Tools: tools}, nil
	}
	return checker.DependencyUpdateToolData{}, fmt.Errorf("dependabot commit search: %w", err)
	}

With that in mind, these could be accomplished with similar means:

• Fuzzing
• License
• Packaging
• SAST
• Security-Policy

However Maintained is a more complex issue. See #1709