Fix scorecard.yml workflow
Workflow was added by #48570, but set ossf/scorecard-action to a major version tag (v2). However, that action only has minor version tags. So it is currently broken. Wasn't caught because the `if github.repository` check skipped the action on my fork, and in my hubris I assumed it'd just work. 🤦 

This PR simply sets the action to the current minor version v2.0.3. Has been checked on my fork, can confirm it works!
No worries, it happens to everyone. 
Thanks for the quick fix.