🐛 Ignore unpinned dependencies in Dockerfiles in vendored directories

[AdamKorcz]

What kind of change does this PR introduce?

This checks whether Dockerfiles being checked by Pinned Dependencies are in a vendor or third_party directory.

(Is it a bug fix, feature, docs update, something else?)

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

What is the new behavior (if this is a feature change)?**

With this PR, Scorecard will check whether any of the subdirectories that a file exists in is called either vendor or third_party.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

#1095

Special notes for your reviewer

Does this PR introduce a user-facing change?

Yes, scores will change, but that is inherited from #1095

Scorecard no longer considers unpinned Dockerfiles in `vendor` and `third_party` directories.

[codecov]

Codecov Report

Merging #3675 (0310029) into main (92470de) will decrease coverage by 5.60%.
The diff coverage is 83.33%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3675      +/-   ##
==========================================
- Coverage   76.12%   70.52%   -5.60%     
==========================================
  Files         205      205              
  Lines       14050    14068      +18     
==========================================
- Hits        10696     9922     -774     
- Misses       2723     3570     +847     
+ Partials      631      576      -55