Refresh the CNCF FOSSA scan and link it from the README #4758

Problem / motivation

CLOMonitor's license_scanning check fails, which holds the license section at 75 and costs about 4 points of the project score (85.95 on 2026-10-05, https://clomonitor.io/projects/cncf/cozystack). The check passes when the README links a FOSSA or Snyk project, or when a .clomonitor.yml metadata file names license_scanning.url (check docs).

The scanning exists but has gone stale. During CNCF onboarding (cncf/sandbox#351, April 2025) the cozystack repositories were quick-imported into the CNCF FOSSA instance, team 83877, with Timur Tukaev (@tym83) as Team Admin. The public FOSSA record for this repository (git+github.com/cozystack/cozystack) still reports last_analyzed_revision bdc3525, the 2025-03-31 commit of #728, and has not been updated since 2025-04-24. It describes a dependency set eighteen months old. CNCF uses these scans to find third-party licenses outside the allowlist, so a stale scan also hides what that review is meant to catch.

Proposed solution

1. Someone with access to the CNCF FOSSA team (Timur Tukaev (@tym83), or a maintainer CNCF adds there) gets continuous analysis running again. Either enable the FOSSA GitHub integration for the imported projects so that pushes to main and release tags are analysed, or create a push-only FOSSA API key and store it as the FOSSA_API_KEY repository secret. With the secret in place, a contributor can add a small workflow that runs fossas/fossa-action (SHA-pinned, to satisfy the zizmor gate) on push to main and on tags.

2. Once a current revision is analysed, point CLOMonitor at it. docs(readme): stop the logo filling the page and thin the badge wall #4222 deliberately thinned the README badge row, so the proposal is a root .clomonitor.yml instead of another badge:

   license_scanning:
     url: https://app.fossa.com/projects/git%2Bgithub.com%2Fcozystack%2Fcozystack

3. Triage whatever the fresh scan flags against the CNCF allowlist. Exceptions go through the CNCF license exception process.

I can send the workflow and the .clomonitor.yml PRs once step 1 is done.

Scope check

• This affects a single component / package (if it spans many, consider a design proposal)
• I can describe the expected behavior concretely (if not, consider a Discussion first)

Alternatives considered

• CNCF Snyk tenancy. CNCF offers it as an alternative, but it would mean a second onboarding when FOSSA is already set up.
• Linking the existing FOSSA project right away. The check would pass, but the project would advertise a scan of a March 2025 tree.
• A FOSSA badge in the README. It works the same as .clomonitor.yml for CLOMonitor, but goes against the badge trim in docs(readme): stop the logo filling the page and thin the badge wall #4222.

Additional context

• CNCF hosted tools: https://contribute.cncf.io/resources/services/hosted-tools/
• Related CLOMonitor work: fix(footer): use the LF Projects copyright notice on every page website#736 (trademark disclaimer) and docs(security): add an OpenSSF Security Insights manifest #4757 (Security Insights manifest).