ci: checkout step for scout job

[crazy-max]

checkout seems suggested when uploading the SARIF report: https://github.com/docker/buildx/actions/runs/10093571745/job/27910395571#step:4:25

  Processing sarif files: ["/tmp/docker-scout-action-72Brf6/result.txt"]
  Validating /tmp/docker-scout-action-72Brf6/result.txt
  Combining SARIF files using the CodeQL CLI
  Adding fingerprints to SARIF file. See https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#providing-data-to-track-code-scanning-alerts-across-runs for more information.
  Could not determine current commit SHA using git. Continuing with data from user input or environment. The checkout path provided to the action does not appear to be a git repository.
  Uploading results
  Successfully uploaded results

I guess this is to determine the origin. That's smth we might need for moby/buildkit#5184 (comment)

Last commit is related to #1715