Feature: Add winget package manager support

**Is your feature request related to a problem? Please describe.** When assessing the security posture of Windows software, there is no way to look up a package by its winget identifier. Users must manually find the source repository before running Scorecard, which is inconsistent with the experience for npm, PyPI, RubyGems, and NuGet. **Describe the solution you'd like** Add a --winget flag that accepts a winget package identifier and automatically resolves the source repository from the [microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs) manifest, then runs Scorecard against it. `scorecard --winget="Notepad++.Notepad++"` **Describe alternatives you've considered** Using the --repo flag directly after manually looking up the repository URL. This works but requires an extra step and breaks the consistency with other package manager flags. **Additional context** Winget is the official Windows package manager with a large and growing catalog. The manifest repository (microsoft/winget-pkgs) is publicly accessible on GitHub and contains the source URL for each package, making resolution straightforward.