Add snyk scan workflow

[hansatgoogle]

Add workflow to run snyk scan following Snyk documentation: https://docs.snyk.io/integrations/snyk-ci-cd-integrations/github-actions-integration/snyk-golang-action.

This workflow can be run manually and will automatically run once a week Sunday night. For now, this is just configured to run snyk test - https://docs.snyk.io/snyk-cli/commands/test. This will scan the repo for vulnerability and license issues and the cli will exit with 1 if any are found.

An example run is here: https://github.com/hansatgoogle/registry/actions/runs/6123960183/job/16622986936. As you can see, this currently finds an issue with a MPL-2.0 license. I don't think that's a concern for us as we aren't likely to modify that library. To get this scan to pass, we could create a custom license policy in snyk (https://docs.snyk.io/manage-risk/policies/license-policies) or remove the dependency if it's not needed.

I've already added SNYK_TOKEN as a repository secret, so the action should work once merged.

[codecov]

Codecov Report

Merging #1223 (24091a4) into main (82fd89e) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1223   +/-   ##
=======================================
  Coverage   71.96%   71.96%           
=======================================
  Files         146      146           
  Lines       12241    12241           
=======================================
  Hits         8809     8809           
  Misses       2749     2749           
  Partials      683      683           

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

📢 Have feedback on the report? Share it here.

[timburks]

Thanks, I think we'll probably leave it to the upstream library to consider removing this dependency. If it seems there's no interest in that, I think we would want to add the exception that you suggested.

[hansatgoogle]

It looks like we could also have a custom policy defined in this repo following https://docs.snyk.io/manage-risk/policies/the-.snyk-file#ignoring-the-license-with-the-cli.

I'll merge this and then we can discuss how to proceed.