Add OSV scanner

[mhucka]

This is almost identical to the latest version of this scanner used in the qsim repository.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.57%. Comparing base (c6c0eff) to head (9a91b4a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7768      +/-   ##
==========================================
- Coverage   99.57%   99.57%   -0.01%     
==========================================
  Files        1102     1102              
  Lines       98425    98425              
==========================================
- Hits        98006    98005       -1     
- Misses        419      420       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pavoljuhas]

Let us run these as scheduled scans to save on resources and avoid user confusion.

Also please move the introduction of osv-scan to its own PR.

[pavoljuhas]

Can you please move this to a separate PR?

Also, let us try to keep this as simple and as close as possible to the example workflows at https://github.com/google/osv-scanner. Running this on schedule should be sufficient; again, we do not need to create noise in CI-checks for our contributors. (we have no large scale continuous deployment of Cirq so it is not that critical to catch vulnerabilities on the spot. Also the only kind of PRs that can introduce them are changes Python dependencies or GHA workflows)

[mhucka]

I moved the Scorecard changes to another PR (#7776)

[mhucka]

In the process of checking more closely what OSV does, I discovered that Dependabot uses the same database. Thus, it turns out that adding OSV as a separate scanner is not necessary!