Integrate osv-scanner workflow

[smoy]

Integrate osv-scanner github action to leverage the vulnerability scanner on every pr

This is an example if osv-scanner find something

[rng1995]

[Automated SkillSpector Review]

Requesting changes. The reusable OSV workflows are commit-pinned and CI is green, but shipping a repository-wide malware advisory exception is not justified. Package removal does not make a locked or vendored malicious dependency safe; remove the exception or provide narrowly scoped, evidence-backed, time-bounded handling that cannot hide a real dependency finding.

[rng1995]

Blocking: do not globally suppress a MAL-* advisory merely because a registry removed the package. If this repository actually references the affected package, that is exactly what the scanner should report; if it does not, no ignore is needed. Remove this entry, or document and enforce a narrowly scoped, expiring exception with evidence.

[smoy]

@rng1995 I have added ignoreUntil to until 2026-07-20

Any plans for the repo maintainer to claim that namespace in pypi to avoid future incidents?

I open issue #240 to mention the process to ask pypi to transfer ownership to copyright owner.

https://docs.pypi.org/project-management/name-retention/#how-to-request-a-name-transfer