QVAC-22733 feat: export CodeScan findings as a downloadable artifact + consolidated report

[GSServita]

🎯 What problem does this PR solve?

• CodeScan findings from the canonical baseline only surface as GitHub Security-tab alerts — and on repos using codeql-upload: never (e.g. qvac on Default setup) they don't surface anywhere consumable at all.
• There's no way to pull a run's findings out for offline triage or to hand to Claude/Cursor for remediation-ticket drafting (the gap raised in the QVAC-19056 Slack thread).

📝 How does it solve it?

• Adds an opt-out export-report input (default true) plus report-retention-days to the reusable public-reusable-security.yml.
• The codeql job now uploads its per-language SARIF as codeql-sarif-<language> artifacts (even when the severity gate fails).
• A new report job consolidates all SARIF into findings.json (flat array: rule, level, security-severity, file, line, message) plus a human/LLM-readable findings.md, uploaded as a single security-scan-report artifact.
• Purely additive: the job's pass/fail result is unchanged, so existing callers behave identically. Especially useful for codeql-upload: never repos, whose findings are otherwise invisible.
• No secret material in any artifact: TruffleHog raw matches are deliberately excluded; only its pass/fail status is recorded.
• Documents the new inputs/behavior in docs/security-baseline.md.

🧪 How was it tested?

• actionlint clean on the modified public-reusable-security.yml.
• Opened as a draft so the repo's security-self-test* callers exercise it end-to-end; will confirm the security-scan-report artifact appears (findings.json + findings.md) and contains no secret values before marking ready for review.
• Follow-up: cut 0.3.0, then bump the qvac caller pin (which also gains a weekly schedule).

🔐 Action pinning

Two artifact actions newly referenced, pinned to SHA + version comment (matching the org's existing pins in tetherto/qvac):

• actions/upload-artifact: added bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
• actions/download-artifact: added 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1

🛡️ Permissions changes

• Scope: job report (new)
• Before: n/a (new job)
• After: contents: read
• Justification: the report job only downloads and reads workflow artifacts; it needs no security-events or pull-requests write. Least privilege.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — findings detected (warn-only)

Critical: 0 · High: 2 · Medium: 0

Dependency	License	Scope	Severity	Outcome
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	(none detected)	runtime	High	blocks
actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f	(none detected)	runtime	High	blocks

How to resolve a blocking finding:

• Remove or replace the disallowed dependency, or
• If the license is genuinely acceptable, run the compliance SKILL and record the decision in .github/license-allowlist.yml (CODEOWNERS-reviewed), or
• For a one-off, a maintainer can apply the license-override label (High findings only; Critical cannot be overridden).

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./hyperbee-models-server
• ./poc-apps-rpchook-server