feat: add security-insights.yml for OSPS baseline scanning

[sonupreetam]

Summary

• Adds security-insights.yml to the project root to enable OSPS Baseline scanning
• Mirrors the structure of the reference file in gemaraproj/gemara
• The baseline-scanner.yml workflow was already present in the repository

Closes #16

Changes

• security-insights.yml: new file declaring schema version, repository metadata, core team, license, and security tooling (Dependabot SCA + CodeQL SAST) following the Security Insights v2 spec

Test plan

• Verify OSPS Baseline Scanner workflow runs successfully after merge
• Confirm security-insights.yml is valid against the Security Insights v2 schema

[jpower432]

Thanks @sonupreetam. Added one suggestion for an additional tool in the list.

[kusari-inspector]

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

No pinned version dependency changes, code issues or exposed secrets detected!

Note

View full detailed analysis result for more information on the output and the checks that were run.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: b53ca96, performed at: 2026-04-08T11:18:19Z

Found this helpful? Give it a 👍 or 👎 reaction!

[kusari-inspector]

Kusari PR Analysis rerun based on - b53ca96 performed at: 2026-04-08T09:56:03Z - link to updated analysis

[sonupreetam]

@kusari-inspector rerun

[kusari-inspector]

🔄 Run triggered at 11:17:56 UTC. Starting fresh analysis...

[kusari-inspector]

Kusari PR Analysis rerun based on - b53ca96 performed at: 2026-04-08T11:18:19Z - link to updated analysis

[sonupreetam]

@eddie-knight & @jpower432 the DCO check failed specifically on the suggestions applied via the GitHub UI (commits 05d3cbf and 8530396 were missing Signed-off-by). So I rebased the branch and force pushed cleanly.

[jpower432]

@sonupreetam This looks good, but I see some extra files in the diff. This might need a rebase before merge.

[sonupreetam]

@jpower432 Yes Thank you for catching this. Updated with the suggestions.