Extend threshold about trusty-action

[yrobla]

Is not that we fail on the action, were are skipping even the reports: malicious, deprecated, etc... are not reported or not considered, if score > threshold. How do we want to tackle that? @lukehinds ^

[yrobla]

@lukehinds i think several features are needed:

• even if we skip the dependencies with score > threshold, should not be reporting on that? i think it still has value to see score, provenance, etc... even if the score > treshold. But we will not make the pr fail
• even if score > threshold, we should be able to configure if we need to fail also for malicious, deprecated, archived... as default. If we want to skip those validations we should explicitly say that on the config
• include new checks for individual scores: typosquatting, hp, activity, etc... report those, and also block prs based on that

wdyt?