ci: move OSV scanning to dedicated workflow

[VinnyBarton]

Summary

• stop requesting vulnerability scanning from the SBOM generator
• add an explicit OSV scan job after source SBOM generation
• require the OSV policy job before Interlynk publication
• require the OSV policy job before release and production Interlynk publication
• store source and release OSV reports as separate artifacts

Dependency

Merge shiftleftcyber/supply-chain-workflows#16 first. Its validated main workflow will move v1 to the commit that provides scan-sbom-osv.yml.

Validation

• Actionlint v1.7.11
• go test ./...
• end-to-end OSV scan of the exact artifact from failed run 37714180636 using the implementation in the shared-workflow PR