feat: download/package OSV scanner and register as MCP server

[capachino]

Makes progress on #25

Tested on my fork https://github.com/capachino/security/releases/tag/v0.1.0

[github-actions]

🤖 Hi @capachino, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

📋 Review Summary

This pull request significantly improves the release process by refactoring the packaging workflow to support multiple platforms (Linux, macOS, Windows) and dynamically downloading the OSV scanner. The separation of the build, package, and upload jobs is a great improvement for clarity and maintainability.

🔍 General Feedback

• The use of a matrix strategy for different platforms is well-implemented.
• Verifying the OSV scanner binary using slsa-verifier is an excellent security measure.
• I've added a couple of minor suggestions to improve the robustness of the shell scripts within the workflow.

Overall, this is a solid improvement to the project's release automation.

[github-actions]

📋 Security Analysis Summary

This Pull Request updates the release workflow to download and package the OSV scanner. The changes are well-structured and the use of SLSA verification for the downloaded binary is a great security practice.

🔍 General Feedback

• The use of eval in the packaging step is a minor security concern. While not directly exploitable in its current form, it's recommended to replace it with a safer alternative to prevent potential issues in the future.

[capachino]

@gemini-cli /review

[github-actions]

🤖 Hi @capachino, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

📋 Review Summary

This pull request introduces a new workflow to package and upload the OSV scanner as a release asset. The overall structure is good, with separate jobs for building, packaging, and uploading, and it includes security best practices like SLSA verification.

🔍 General Feedback

• The workflow is well-structured and easy to follow.
• The use of a matrix strategy for different platforms is efficient.
• Including SLSA verification for the downloaded binary is an excellent security measure.
• I found one critical issue in the packaging script that will affect the Windows release, which I've commented on directly.

[github-actions]

## 📋 Security Analysis Summary

No vulnerabilities were found in this pull request.

🔍 General Feedback

The changes in this pull request are well-structured and follow best practices. The use of slsa-verifier to verify the downloaded binary is a great security control.