add OSV-Scanner CI for deps and images

[atkrad]

Summary

• Add OSV-Scanner PR differential scan and weekly/main full source scan (SHA-pinned reusable workflows)
• Gate Release on a linux/amd64 container image scan with SARIF upload to Code Scanning
• Ignore uncalled GO-2026-5932 (x/crypto/openpgp) in osv-scanner.toml so image scans stay actionable

Related

Fixes #60

Test plan

• Unit tests added/updated (N/A, CI-only)
• Scenario under scenarios/ (N/A)
• actionlint clean on the new/changed workflows
• Manual smoke: local osv-scanner source scan; built amd64 image, archived, scanned with config (exit 0, SARIF valid)
• Confirm GitHub Actions runs on this PR (OSV PR scan) and SARIF appears under Security → Code scanning after merge/schedule

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/) (N/A)
• No secrets or local-only paths in the diff

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.