Improve Score Reporting: Signed-Release and Packaging checks

[azeemshaikh38]

We do terribly on Signed-Releases and Packaging checks for ecosystems and projects which do not release on GitHub or using GitHub actions. Some ideas to improve here:

• Look for git tags to check for releases and ensure that these tags are signed/verified.
• Extending the above point, see if we can find associated release artifacts on package repositories.
• Improve the packaging workflow list which we use to detect packaging in GH actions.

[laurentsimon]

• Look for git tags to check for releases and ensure that these tags are signed/verified.

Not clear this how much improvement this is. Tags are in the commit history. This is different from binaries stored in release assets (that can be altered without commit history changes) and / or registry packages.

• Extending the above point, see if we can find associated release artifacts on package repositories.

this is covered in https://github.com/ossf/scorecard/issues/688