ci: skip scorecard outside main

.github/workflows/security-extra.yml

@@ -174,6 +174,7 @@ jobs:
   scorecard:
     name: OpenSSF Scorecard
     runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
 
     permissions:
       contents: read
@@ -196,4 +197,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: scorecard.sarif
-          category: openssf-scorecard
+          category: openssf-scorecard