BUILD-11270: Add README for check-sca action

[bwalsh434]

What Changed?

• Adds README for check-sca action
• Changes local check-sca action invocation to use github-ubuntu-latest-s per the docs

[hashicorp-vault-sonar-prod]

BUILD-11270

[sonar-review-alpha]

Summary

This PR adds documentation for the check-sca action and updates the internal test workflow. The new README section covers the action's purpose (verifying SonarQube SCA ran for a project), its requirements (GitHub permissions and Vault access), usage examples, and all inputs/outputs. The workflow file has been updated to use the local action reference and changed to github-ubuntu-latest-s runner, which aligns with the documentation guidance for public repositories.

What reviewers should know

Start with: The README section at the bottom of the file (## check-sca) shows the full user-facing documentation including the recommended runner choice for different scenarios.

Key points for reviewers:

• The workflow file is now a self-testing example—it uses sparse-checkout to fetch only the action directory and then runs ./check-sca locally instead of calling the remote version. This is intentional and good practice for GitHub action repositories.
• The runner changed from ubuntu-latest to github-ubuntu-latest-s. The README documents this choice: private repos should use sonar-xs, public repos should use github-ubuntu-latest-s.
• The README documents the action's discovery mechanism (looks for project keys in multiple config files), required permissions (id-token: write and contents: read), and Vault access needs.
• All three inputs have defaults and are optional; all outputs are conditionally set based on success/failure.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[Copilot]

Pull request overview

Adds end-user documentation for the new check-sca GitHub Action to the repository’s main README, including requirements, usage, inputs, and outputs.

Changes:

• Adds check-sca to the README action index.
• Introduces a new ## check-sca section documenting behavior, requirements, and configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Solid documentation addition — the inputs, outputs, Vault paths, permissions, and project-key discovery description all match the implementation. The workflow changes (runner, sparse-checkout, local action reference) are consistent with how test-build-number.yml and test-pr-cleanup.yml handle the same pattern.

🗣️ Give feedback