Company names are not validated

In the Collaborators check, we fetch the names of companies the user belongs to.
These names can be set by users arbitrarily. If scorecard users take into account the company of contributors to make decisions, these names should be verified.

We may use the list-org API instead.

Another problem is that we currently do not check how many companies a user belongs to. A contributor (we currently enforce >5 commits) can set any number of companies they want and it will pass the test. We're not enforcing a single company per user. (Is this an invariant we can enforce?)

A limitation of this check is that organization should update when users leave.

It's pretty easy to typo-squat orgs too, see https://github.com/GoogleContainerTooIs vs https://github.com/GoogleContainerTools.
So we should always verify the org is 'verified', like https://github.com/google

One limitation of the 'verified' org is that it seems to verify the domain ownership, but there is no enforcement about the org name itself.