[ci] Scan Python lockfiles with OSV-Scanner

[rebtoor]

Summary

• Add an OSV-Scanner GitHub Action that audits committed requirements.lock.<stream> files (the pip-compile output actually installed in images), not unpinned pythondeps.txt.
• Pull requests fail only when they introduce new vulnerabilities, so OpenStack upper-constraints does not block every change.
• Weekly / main runs upload a full SARIF inventory to Security → Code scanning without failing the job. Accepted exceptions go in osv-scanner.toml.
• Enable Dependabot for github-actions SHA pins only. The pip ecosystem is omitted because versions are constrained and refreshed by update-sources.

Test plan

• Confirm this PR's OSV-Scanner / PR (new vulnerabilities) job runs (the workflow file is in the path filter) and does not fail on inherited findings.
• After merge, run Actions → OSV-Scanner → Run workflow and confirm SARIF appears under Security → Code scanning. If upload fails, Code Scanning may need enabling for the repo (upload-sarif: true on the inventory job).
• Confirm a docs-only PR does not trigger this workflow.
• Confirm Dependabot opens weekly PRs for GitHub Action pin updates.

Made with Cursor

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign elfiesmelfie for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment