chore: add SCA scan workflow

[nir-test-ac]

✏️ Changes

This pull request adds a security hardening workflow from the unified-pipeline-template (https://github.com/atko-cic/unified-pipeline-template/security). No functional changes are introduced.

SCA Scan

This PR adds .github/workflows/sca.yml from the unified-pipeline-template. It uses okta approved sca workflow from auth0/devsecops-tooling : 'auth0/devsecops-tooling/.github/workflows/sca-scan.yml@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e'

⚠️ Before merging, review the added .github/workflows/sca.yml and make the changes described below, plus any other adjustments your CI environment requires.

Placeholders to fill in before merging

Placeholder	Description
SHA in uses:	Replace "replace with tagged SHA" SHA with the current pinned SHA

Required org secrets (must be present)

• SNYK_TOKEN
• SIGNAL_HANDLER_TOKEN
• SIGNAL_HANDLER_DOMAIN

🔮 Type of Change

• Standard

🔗 References

https://auth0team.atlassian.net/browse/SEPIO-1674

• I added at least one link (task, slack thread, etc) to explain why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.