chore: replace inline osv-scanner and scorecard steps with org-infra reusable workflows

[yvonnedevlinrh]

Problem

.github/workflows/ci_security.yml and .github/workflows/ci_scheduled.yml both pin two action SHAs that no longer resolve:

• google/osv-scanner-action/osv-scanner-action@e5012758... (v2.0.2)
• ossf/scorecard-action@05b42c62... (v2.4.2)

Both hard-fail with:

Unable to resolve action ..., unable to find version <sha>

ci_security.yml fails this on every PR (including PR #40). ci_scheduled.yml will hit the same failure on every nightly cron run.

A previous attempt to fix the OSV SHA was reverted (89ea9d7) because bumping the SHA alone is not sufficient — the upstream action also changed form from an inline step to its own reusable workflow caller, making this a structural change, not just a version bump.

Proposed change

Replace the inline jobs in both files with org-infra reusable workflow callers, mirroring complytime/.github (the peer .github admin repo):

ci_security.yml — replace two inline jobs with:

jobs:
  call_reusable_vuln_scan:
    name: OSV-Scanner
    permissions:
      contents: read
      actions: read
      security-events: write
      packages: write   # required by reusable even when trivy image scan is skipped
      id-token: write   # required by reusable even when trivy image scan is skipped
    uses: complytime/org-infra/.github/workflows/reusable_vuln_scan.yml@<sha> # <version>

  call_reusable_security:
    name: OpenSSF Scorecards
    permissions:
      contents: read
      id-token: write
      security-events: write
    uses: complytime/org-infra/.github/workflows/reusable_security.yml@<sha> # <version>
ci_scheduled.yml — replace two inline jobs with a single call:
jobs:
  call_reusable_scheduled:
    name: OSV-Scanner and Scorecards
    permissions:
      contents: read
      actions: read
      security-events: write
      id-token: write
    uses: complytime/org-infra/.github/workflows/reusable_scheduled.yml@<sha> # <version>

Both files pin org-infra at the same SHA already used by unbound-force/unbound-force and complytime/.github.

Canonical references

• complytime/.github/.github/workflows/ci_security.yml — peer .github admin repo implementation
• complytime/.github/.github/workflows/ci_scheduled.yml — peer .github admin repo implementation
• unbound-force/unbound-force/.github/workflows/ci_security.yml — org canonical caller
• complytime/org-infra/.github/workflows/reusable_vuln_scan.yml — OSV reusable
• complytime/org-infra/.github/workflows/reusable_security.yml — Scorecard reusable
• complytime/org-infra/.github/workflows/reusable_scheduled.yml — combined scheduled reusable

Acceptance criteria

• ci_security.yml calls reusable_vuln_scan.yml and reusable_security.yml from complytime/org-infra, both pinned by SHA with a version comment
• ci_scheduled.yml calls reusable_scheduled.yml from complytime/org-infra, pinned by SHA with a version comment
• The OSV-Scanner and OpenSSF Scorecards hard-fails are resolved in PR CI
• The nightly cron no longer fails on dead action SHAs
• Existing inline osv-scanner and scorecards jobs removed from both files
• packages: write and id-token: write present on the call_reusable_vuln_scan job in ci_security.yml