Feedback on Scorecard result data

I had a conversation with Jose Duart from Google and he had some interesting observations on Scorecard data from BQ that he analyzed.

1. Some repos may be pretty well established (e.g https://github.com/yaml/pyyaml), so not a lot of commits will be happening. We mark these repos as Not Active, which is unexpected from a users POV. We probably need better signals to understand if repos are Active or improve how we score these repos.
2. The Vulnerabilities check simply tells if there is an open vulnerability or not. This is not a strong signal when considering a package as a dependency. A stronger signal might be something like - how long do the repo owners take on average to fix vulnerabilities once they become known.

These might be interesting points to discuss in our next meeting, so creating an issue.

Review the existing activity and Vulnerabilities checks and their current scoring definitions; the issue names no files, tests, or entry points. Clarify which signals and acceptance criteria are desired before implementation, then add tests for the agreed scoring behavior.