ci: add post-merge SCANOSS license & BOM check

[arav-agarwal2]

Hello folks! As part of AI-code policy changes at MLC, we're trying to role out AI-generated code checks to catch if licensed code from bad licenses end up in the codebase.

This PR adds a SCANOSS license & BOM check that runs after merge to master (and on manual dispatch). It's informational only and never blocks.

• .github/workflows/scanoss.yml: scans only the files changed in the pushed range (before..sha), not the whole tree, using scanoss-py against api.osskb.org. It then:
  • converts the results to a CycloneDX BOM
  • runs the copyleft and undeclared-component inspections (these steps use continue-on-error)
  • writes a report to the run's Summary: a file → component / match % / license table that flags copyleft, non-commercial, or non-permissive licenses, plus the remaining per-key osskb quota when SCANOSS_API_KEY is set
  • uploads everything in scanoss-reports/ as an artifact that's kept for 30 days
• .github/scanoss.json: scan settings that skip tests, vendored and third-party dirs, node_modules, and generated protobuf files, and declare pkg:github/mlcommons/mobile_app_open in the BOM.

Once this is merged, I'll need to add a SCANOSS_API_KEY repo secret so the system doesn't hit rate limits, so please add me to the repo so I can add that information accordingly if possible.

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[freedomtan]

@anhappdev please take care of this.

[anhappdev]

LGTM. For setting the SCANOSS_API_KEY please contact @mlcommons/admin

[anhappdev]

@arav-agarwal2 Please pin any Github actions to commit SHA.