fix(ci): scorecard-enforcer reads the real OSSF score (JSON, not SARIF)

fix(ci): scorecard-enforcer reads the real OSSF score (JSON, not SARIF) #341