Interface with CHAOSS

[lucasgonze]

For the purposes of OpenSSF work there may be a benefit from linking to the CHAOSS group doing community health metrics.

CHAOSS currently has two relevant metrics:

• https://chaoss.community/metric-cii-best-practices-badge/
• https://chaoss.community/metric-spdx-document/

Those are fairly general. They include but don't drill down into security practices.