Security improvements

[matmair]

Some small improvements:

• Moves content write permission into the job
• Enables upload of OSSF scorecard in real-time
• Pins QC/Docker dependencies to enhance reproducibility
• Adds SonarCloud as a SAST provider replacing deepsource

Closes #6494

[netlify]

✅ Deploy Preview for inventree-web-pui-preview ready!

Name	Link
🔨 Latest commit	a814ee4
🔍 Latest deploy log	https://app.netlify.com/sites/inventree-web-pui-preview/deploys/660b98d0cf5af30008929c74
😎 Deploy Preview	https://deploy-preview-6890--inventree-web-pui-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 100 (no change from production) Accessibility: 86 (no change from production) Best Practices: 100 (no change from production) SEO: 70 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[matmair]

This is ready for a review. For enabling SonarCloud @SchrodingersGat will have to approve the App Installation. In that step we can also remove the permissions for deepsource.

[SchrodingersGat]

@matmair sonarcloud is now setup, and I am happy with this PR. Please advise if I should merge this in or wait for further steps

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[sonarcloud]

Quality Gate failed

Failed conditions
6.4% Duplication on New Code (required ≤ 3%)

See analysis details on SonarCloud

[matmair]

@SchrodingersGat this is ready for merge now