de-duplicate SAST workflow scanning

[spencerschrock]

Between the 3 existing detected SAST tools, there's a lot of duplication:

scorecard/checks/raw/sast.go

Lines 57 to 75 in 2ef20f1

	codeQLWorkflows, err := codeQLInCheckDefinitions(c)
	if err != nil {
	return data, err
	}
	data.Workflows = append(data.Workflows, codeQLWorkflows...)
	sonarWorkflows, err := getSonarWorkflows(c)
	if err != nil {
	return data, err
	}
	data.Workflows = append(data.Workflows, sonarWorkflows...)
	snykWorkflows, err := getSnykWorkflows(c)
	if err != nil {
	return data, err
	}
	data.Workflows = append(data.Workflows, snykWorkflows...)
	return data, nil

(although getSonarWorkflows might be a special case?)

Especially as more tools are added (#3743 ), we shouldn't have the same code copy/pasted for each workflow detection.

It seems like there's a common state for these github action detections:
mapping some SASTWorkflowType value (Snyk, Sonar, CodeQL, etc) to some action regex:

Snyk: strings.HasPrefix(action, "snyk/actions/")
CodeQL: action == "github/codeql-action/analyze"

so as regex maybe?
Snyk: "^snyk/actions/.*" (prefix)
CodeQL: "^github/codeql-action/analyze$" full match
qodona: "^JetBrains/qodana-action$" full match
pysa: "^facebook/pysa-action$" full match

[DavidKorczynski]

Added fix in #3743