feat: Add schema for project BPB files

[eddie-knight]

Background

While working on the upcoming release for Security Insights v2, I began considering the suggestions from @david-a-wheeler in ossf/security-insights-spec#94.

Problem

While I was able to quickly add some of the suggested values to SIv2, there are a great deal more that didn't get included either due to incompatibility or simply oversight. The gap is massive between SI and BPB, where both provide unique but related value to users.

Solution

There is potential to create more value by allowing project contributors to specify their best practices status in security insights, but maintain their BPB answers in a static version controlled location that can be linked from the SI file.

In a future PR, we can add a feature to BPB that will inspect the project's answers file to issue a badge.

In this Pull Request

This PR includes a Cue schema which will allow for validation of YAML, JSON flavors, and TOML files containing answers to the best practices badge criteria. A corresponding YAML file is included.

The schema matches the pattern and layout of the web form, always requires Passing to be complete, and additionally requires Silver to be completed before moving on to Gold.

Note

Cue was selected for simplicity of maintenance and use.

To validate a YAML or JSON file, install Cue and then run this command format: cue vet schema.cue example-full.yml