Is your feature request related to a problem? Please describe.

It appears that the config file-finding code only looks for files with a .yml extension, e.g., scorecard.yml. However, the official extension for the YAML format is .yaml, and therefore some users are likely to name their Scorecard config file with .yaml without thinking about it. Scorecard would better serve its users if it automatically considered both .yml and .yaml extensions when looking for its config file.

Describe the solution you'd like

By default, when looking for a config file, Scorecard could check both .yaml and .yml variants of the file name.

Describe alternatives you've considered

Users can use a command-line option to specify the config file to use no matter what its name is. This works today, but requires extra configuration steps.

Additional context

Many other tools today allow their config files to use either extension. Since it's annoying and error-prone for users to mix .yml and .yaml in their repositories, those users who settle on .yaml for other files are likely to want to use the same extension for their Scorecard configuration file.