Onboard new backport-pr re-usable github workflow (security-analytics)

[peterzhuamazon]

Description

Onboard new backport-pr re-usable github workflow (security-analytics)

Issues Resolved

opensearch-project/opensearch-build#6270

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 937af0f.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
.github/workflows/backport.yml	12	high	Reusable workflow referenced by mutable branch ref '@main' instead of a pinned commit SHA. Any change to 'opensearch-project/opensearch-build/.github/workflows/backport-pr.yml' on the main branch will automatically be picked up without review, enabling a supply chain attack if that repository is compromised or a malicious commit is merged there.
.github/workflows/backport.yml	13	high	The OPENSEARCH_CI_BOT_TOKEN secret is passed to an externally-owned, mutable reusable workflow triggered by 'pull_request_target' (which runs in the base repo context with full secret access). This combination is a well-known secret-exfiltration vector: a malicious actor who can modify the referenced external workflow could harvest the token.

The table above displays the top 10 most important findings.

Total: 2 | Critical: 0 | High: 2 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.