Security (OSS-CLI) #233

Job	Run time
jscpd (duplication < 3% on touched code)	15s
Trivy (filesystem + container scan)	15s
Semgrep (SAST)	26s
OSV-Scanner (SCA)	49s
SBOM (SPDX + CycloneDX)	20s
Gitleaks (secret scan)	12s
	2m 17s

Provide feedback