ci(security): add OSV and Trivy scans with fork-safe SARIF and SBOM generation

[niStee]

This PR adds supply-chain security scanning with:

• OSV Scanner for dependency vulnerabilities (non-blocking)
• Trivy FS for file system vulnerabilities (non-blocking)
• SBOM generation with Syft (CycloneDX format)
• DevSkim workflow hardening with fork-safety guards

Key Features

All scanning workflows:

• ✅ Use Docker image digest pinning for reproducibility
• ✅ Guard SARIF uploads against forks to prevent permission errors
• ✅ Include concurrency controls to prevent duplicate runs
• ✅ Are intentionally non-blocking to establish a baseline

Files Changed

• .github/osv-scanner-config.yaml (new) - OSV severity filters
• .github/workflows/osv-scan.yml (new) - OSV Scanner workflow
• .github/workflows/trivy-fs.yml (new) - Trivy FS workflow
• .github/workflows/sbom.yml (new) - SBOM generation workflow
• .github/workflows/check_security_vulnerability.yml (updated) - DevSkim hardening

Related Issues

Relates to #1309 - this is a cleaner implementation with only security scanning features, no breaking changes.