x/pkgsite: handle packages from an archived repo specially

[jba]

If a repo has been archived (as described for GItHub here), we should reduce its search rank, and add an indicator to its pages.

[myitcv]

Somewhat related to #40357

[BenjamenMeyer]

This might be easier than #41126 (comment) since GitHub allows a repository to be marked as an archive, the integration with GitHub should be able to detect that the owner archived it.
Indeed, the GetRepository API call to GitHub (https://docs.github.com/en/rest/repos/repos#get-a-repository) has an archived attribute on the result, which also shows up in https://docs.github.com/en/rest/repos/repos#list-organization-repositories.

Seems like the mechanics for updating the data in pkg.go.dev should be able to easily detect this flag being set and put up a notice like GitHub does regarding archived repositories:

[goto1134]

https://github.com/ossf/scorecard (https://securityscorecards.dev/) contains that information in their public API. In fact, all the Scorecard checks can be retrieved from https://deps.dev/, which is already queried from the frontend.

Therefore, there is no need to be dependent on GitHub API. Also, the archived repositories from other VCS hostings would be available if they are provided.

We could use this data to add an indicator.

As for the search ranking, it is unclear whether we should add an extra step for the workers to store the checks in the database or not.

@jba, what do you think about that?