build: add vulnerability scan to PR build

[bestbeforetoday]

Continue build on vulnerability detection.

Update protobuf dependency to address vulnerabilities:

• CVE-2022-25647
• CVE-2022-3509
• CVE-2022-3510
• CVE-2022-3171

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[bestbeforetoday]

I had to back off from using the OSV-Scanner GitHub Action since multiple scan runs all appear to upload security analysis results with the same name. The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

[vbarua]

The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

How will we see the results of the scan? Are they added as comments to PRs?

[bestbeforetoday]

The scan jobs will fail if a vulnerability is detected and will show up as failed build checks against the PR. Unless they are required checks, it should not prevent changes being merged though.

An alternative might be to have a scheduled workflow that runs (perhaps daily) on the main branch content. It depends what you prefer.

[vbarua]

Changes look good to me. Thanks for adding this capability to our build ✨