Bump github.com/ossf/scorecard/v4 from 4.10.5 to 4.12.0

Bumps [github.com/ossf/scorecard/v4](https://github.com/ossf/scorecard) from 4.10.5 to 4.12.0.
- [Release notes](https://github.com/ossf/scorecard/releases)
- [Changelog](https://github.com/ossf/scorecard/blob/main/RELEASE.md)
- [Commits](ossf/scorecard@v4.10.5...v4.12.0)

---
updated-dependencies:
- dependency-name: github.com/ossf/scorecard/v4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

go.mod

@@ -4,18 +4,19 @@ go 1.16
 
 require (
 	github.com/Masterminds/semver/v3 v3.2.1
-	github.com/bradleyfalzon/ghinstallation/v2 v2.4.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.6.0
 	github.com/evanphx/json-patch v5.6.0+incompatible
 	github.com/gobwas/glob v0.2.3
+	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/google/go-cmp v0.5.9
 	github.com/google/go-github/v50 v50.2.0
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
 	github.com/matryer/is v1.4.0 // indirect
-	github.com/ossf/scorecard/v4 v4.10.5
+	github.com/ossf/scorecard/v4 v4.12.0
 	github.com/rhysd/actionlint v1.6.24
 	github.com/rs/zerolog v1.29.1
 	github.com/shurcooL/githubv4 v0.0.0-20210725200734-83ba7b4c9228
-	gocloud.dev v0.29.0
-	golang.org/x/sync v0.2.0
+	gocloud.dev v0.33.0
+	golang.org/x/sync v0.3.0
 	sigs.k8s.io/yaml v1.3.0
 )