fix: filter FOSSA false positive for pinned k8s.io/client-go

[SebTardif]

Problem

The FOSSA License Check on PR #315 (release v0.1.16) fails with:

Outdated dependency detected in k8s.io/client-go@v0.36.2

This is a false positive: k8s.io/client-go@v0.36.2 is the latest stable version, pinned to match the K8s v0.36.x API version that Attune targets.

Solution

• Add scripts/fossa-filter.py to strip known false positives from fossa test output while preserving genuine issue detection
• Update .github/workflows/fossa.yaml to run fossa test --format json through the filter script
• The filter supports both JSON-based and text-based (fallback) filtering, since FOSSA quality issues sometimes produce empty JSON output

False positive patterns handled

Package prefix	Issue type	Reason
k8s.io/	outdated	Pinned to match target K8s API version
golang.org/x/text	CC-BY-SA	Unicode CLDR data files; module is BSD-3-Clause
golang.org/x/crypto	openssl-ssleay	Test fixture files; module is BSD-3-Clause

Testing

Verified locally with simulated FOSSA output:

• Known false positives are filtered (exit 0)
• Genuine issues are preserved (exit 1)
• Empty JSON falls back to text-based filtering
• Mixed results correctly separate false positives from genuine issues