ci(sec-scorecard): add 20m timeout and disable unconfigured repo_token

[Ian-wang-liyang]

Which problem does the PR fix?

Closes #6323.

What's in this PR?

Hardens the non-blocking Security - Scorecard workflow (.github/workflows/sec-scorecard.yaml).

1. timeout-minutes: 20 on the analysis job. The job had no timeout, so a transient GitHub GraphQL 503 mid-analysis (run 26908556266) made the action retry against the degraded endpoint for 1h5m before failing. The timeout now fails fast on upstream outages.

2. Commented out the repo_token line. It referenced secrets.SCORECARD_TOKEN, which is not configured anywhere in the repo or org (single reference, no README badge, no docs). Every run logged The 'repo_token' variable is empty. Using the 'INPUT_INTERNAL_DEFAULT_TOKEN' variable instead. and fell back to GITHUB_TOKEN. Commenting it out restores the upstream scorecard-action starter default, silences the per-run auth notice and the IDE Context access might be invalid: SCORECARD_TOKEN diagnostic, and keeps the adjacent "Uncomment the line below…" comment accurate. Reversible by one uncomment if an admin later adds the PAT to enable full Branch-Protection scoring.

Deliberately not done (out of scope for #6323):

• No 503 retry wrapper. Retry is optional per the issue, a re-run clears the transient 503, and the job is non-blocking. Retrying a uses: step would require a third-party retry action (Wandalen/wretry); this repo uses zero third-party retry deps (only bash loops / curl --retry / scripts/harbor-retry.sh). The 20m timeout already removes the 1h hang.

Follow-ups (separate issues/PRs):

• An org/admin can add the SCORECARD_TOKEN PAT and uncomment the line to enable the OSSF Branch-Protection check.
• ~36 jobs across ~20 workflow files lack timeout-minutes. Worth a separate hardening pass; highest-risk (Harbor + GitHub API callers): chart-release-public.yaml (release/post-release), chart-build-dev.yaml (build), chart-release-artifact-verify.yaml (verify), chart-promote-rc.yaml (promote-rc).

Checklist

Please make sure to follow our Contributing Guide.

Before opening the PR:

• In the repo's root dir, run make go.update-golden-only.
• There is no other open pull request for the same update/change.
• Tests for charts are added (if needed).
• In-repo documentation are updated (if needed).

After opening the PR:

• Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
• Did all checks/tests pass in the PR?

[Copilot]

Pull request overview

Hardens the non-blocking Security - Scorecard GitHub Actions workflow by preventing long-running hangs during upstream GitHub API degradation and by removing an ineffective, unconfigured token input.

Changes:

• Add a timeout-minutes: 20 limit to the analysis job to fail fast instead of consuming excessive runner time during transient outages.
• Comment out repo_token: ${{ secrets.SCORECARD_TOKEN }} so the workflow uses the action’s default token behavior without emitting “repo_token is empty” notices.