ci: migrate ci_security and ci_scheduled to org-infra reusable workflows

[yvonnedevlinrh]

Summary

Replaces the inline osv-scanner and scorecard-action steps in ci_security.yml and ci_scheduled.yml with calls to the complytime/org-infra reusable workflows. Both files were pinning action SHAs that no longer resolve upstream, causing hard CI failures on every PR and every nightly cron run.

• ci_security.yml → reusable_vuln_scan.yml + reusable_security.yml
• ci_scheduled.yml → reusable_scheduled.yml

Both files are now pinned at 0c784711 # v0.7.1, matching unbound-force/unbound-force and complytime/.github.

Related Issues

• Closes chore: replace inline osv-scanner and scorecard steps with org-infra reusable workflows #42

Review Hints

• The OSV action changed form between v2.0.x and v2.5.x — it moved from an inline step to a reusable workflow caller. A previous attempt to fix this (commit 89ea9d7) was reverted because only the SHA was bumped without the structural change. This PR handles both.
• packages: write and id-token: write on call_reusable_vuln_scan are required by the reusable even when Trivy image scanning is disabled — omitting them causes a runtime permission error.
• ci_checks.yml is intentionally not migrated — its inline Go lint/test jobs are repo-specific and not covered by reusable_ci.yml.
• ci_dependencies.yml is covered separately by issue chore: replace inline dependency-review-action with org-infra reusable workflows #41

Known Issues

• Dependency Review — pre-existing failure, unblocked once issue chore: replace inline dependency-review-action with org-infra reusable workflows #41 is resolved
• Scorecard (security-events: write on ci_scheduled.yml) — one-time new-alert from GitHub code scanning; reusable_scheduled.yml requires this permission for SARIF upload and matches complytime/.github exactly. Will not appear on future PRs once this is on main

This PR was generated by /uf.finale (AI-assisted).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[yvonnedevlinrh]

Merge this first — it unblocks #44

This PR fixes the dead-SHA failures that are currently red on main (and therefore on every open PR, including #44):

google/osv-scanner-action@e5012758…  → unable to find version
ossf/scorecard-action@05b42c62…      → unable to find version

On this PR, the migrated checks pass ✅

• OSV-Scanner / OSV-Scanner / osv-scan → pass
• OpenSSF Scorecards / OpenSSF Scorecards → pass

The two red checks still shown here — Dependency Review and Scorecard — are the legacy inline jobs from main running against this PR (the old dependency-review-action hard-fail and the old dead-SHA scorecard). They disappear from main once this PR merges; they are not produced by the new code in this PR.

Merge order

1. Merge this PR (ci: migrate ci_security and ci_scheduled to org-infra reusable workflows #43) first — restores green security workflows on main.
2. Then rebase/update fix: migrate ci_dependencies to org-infra reusable workflows #44 (fix: migrate ci_dependencies…) on the new main; its inherited OSV/Scorecard failures will clear.

Minor note: this PR and #44 both add openspec/config.yaml (identical 1-line scaffold), so expect a trivial, same-content conflict on that file when the second PR rebases.

[marcusburghardt]

LGTM