Add OSV Scanner for vulnerability scans

[stnguyen90]

What does this PR do?

This workflow action uses OSV Scanner, an open source vulnerability
scanner by Google. We're using OSV Scanner because it has:

• good usability - JSON output and multiple options
• good accuracy - OSV database from google and support
  for multiple languages including PHP

Test Plan

None

Related PRs and Issues

• 🚀 Feature: Security Scans like SAST, DAST, FOSS, CAST in pipeline #5232

Checklist

• Have you read the Contributing Guidelines on issues?
• If the PR includes a change to an API's metadata (desc, label, params, etc.), does it also include updated API specs and example docs?

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[abnegate]

@stnguyen90 I don't see any analysis results here, the comment above makes it sound like there should be results even if there were no issues detected, is that correct?

[stnguyen90]

@abnegate I think it'll show up once this is merged and the scan runs on main