ci(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml

Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) from 2.2.1 to 2.3.8.
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@456ceb7...9a49870)

---
updated-dependencies:
- dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml
  dependency-version: 2.3.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/osv-scanner.yml

@@ -57,7 +57,7 @@ jobs:
     # MAJOR-level guidance). The reusable-workflow `uses:` form accepts a SHA
     # in place of a tag. Adjacent version comment marks the floating-tag intent
     # so Dependabot github-actions can offer upgrades.
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@456ceb78310755116e0a3738121351006286b797"  # v2.2.1
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2"  # v2.3.8
     with:
       scan-args: |-
         --recursive