The scriptSig is:
OP_DUP OP_HASH160 404371705fa9bd789a2fcd52d2c580b65d35549d OP_EQUALVERIFY OP_CHECKSIG
How did people know that this was the correct permutation of OPCodes and data?
Bitcoin Script is a programming language. As such, it is similar to other languages - You need to know what you are trying to achieve to be able to write in it.
The script you've presented is a P2PKH (pay-to-pubkey-hash) script. The goal here is to allow someone to spend Bitcoin with the corresponding private key by applying a signature. In this kind of verification, you take the input pubkey, duplicate it (OP_DUP), hash160 the duplicate (OP_HASH160), push the hashed value, check if the value you created in the first two operations matches the one you just pushed (OP_EQUALVERIFY), and finally check the signature against the original, pre-dup pubkey (OP_CHECKSIG)
Since Bitcoin Script is a stack based language, it looks a little different to the day to day ones we see (Python, Java, etc). However, it is just another programming language, and you can write code in it just the same way.
Just for reference, a similar program in a more conventional language would look something like:
verifyInputScript(signature, pubkey, outputscript): inputPubkeyHash160 = hash160(pubkey) if inputPubkeyHash160 != outputscript.hash160: return "Invalid" else: isSignatureValid = verifySignature(signature, pubkey) return isSignatureValid