Feature: Only initialize what is needed

[pnacht]

Is your feature request related to a problem? Please describe.
#3464 shows a case (pytorch/pytorch) where a project is too big to be handled by the default values passed to the GraphQL client when running Scorecard.

However, this is the case even when running only Token-Permissions on pytorch:

scorecard --repo pytorch/pytorch --checks Token-Permissions
Error: RunScorecard: internal error: ListCommits:error during graphqlHandler.setup: internal error: githubv4.Query: non-200 OK status code: 502 Bad Gateway body: "{\n   \"data\": null,\n   \"errors\":[\n      {\n         \"message\":\"Something went wrong while executing your query. This may be the result of a timeout, or it could be a GitHub bug. Please include `9C92:7937:4AB1C92:9882206:654E36E9` when reporting this issue.\"\n      }\n   ]\n}\n"
2023/11/10 13:58:13 error during command execution: RunScorecard: internal error: ListCommits:error during graphqlHandler.setup: internal error: githubv4.Query: non-200 OK status code: 502 Bad Gateway body: "{\n   \"data\": null,\n   \"errors\":[\n      {\n         \"message\":\"Something went wrong while executing your query. This may be the result of a timeout, or it could be a GitHub bug. Please include `9C92:7937:4AB1C92:9882206:654E36E9` when reporting this issue.\"\n      }\n   ]\n}\n"

Looking at the code, I understand that Token-Permissions only uses the repo's tarball (fetched with the HTTP client) and doesn't rely on the GraphQL API. This check therefore shouldn't be impacted by issues setting up the graphQL client.

Describe the solution you'd like
Setup of each client should only happen if it will actually be used.

[spencerschrock]

Looking at the code, I understand that Token-Permissions only uses the repo's tarball (fetched with the HTTP client) and doesn't rely on the GraphQL API. This check therefore shouldn't be impacted by issues setting up the graphQL client.

For most things, Scorecard does lazy evaluate clients. The problem is this particular query always runs since we put the commit SHA in the run metadata:

scorecard/pkg/scorecard.go

Lines 110 to 124 in 934f170

	versionInfo := version.GetVersionInfo()
	ret := ScorecardResult{
	Repo: RepoInfo{
	Name: repo.URI(),
	CommitSHA: commitSHA,
	},
	Scorecard: ScorecardInfo{
	Version: versionInfo.GitVersion,
	CommitSHA: versionInfo.GitCommit,
	},
	Date: time.Now(),
	}
	commitSHA, err := getRepoCommitHash(repoClient)

That being said, there's other ways we can get this data. I'll take a stab at this