chore: add ReversingLabs malware scan workflow

[nir-test-ac]

✏️ Changes

This pull request adds a security hardening workflow from the unified-pipeline-template (https://github.com/atko-cic/unified-pipeline-template/security). No functional changes are introduced.

ReversingLabs Malware Scan

This PR adds .github/workflows/rl.yml from the unified-pipeline-template. It uses okta approved malware scan action from auth0/devsecops-tooling : 'auth0/devsecops-tooling/.github/actions/rl-scan@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e'

⚠️ Before merging, review the added .github/workflows/rl.yml and make the changes described below, plus any other adjustments your CI environment requires.

⚠️ Required before this scan will run — provide the artifact one of two ways:

1. Upload & pass: in a prior job build and upload the artifact with actions/upload-artifact, keep the Download artifact step in this workflow, and set artifact-name/artifact-path to match the upload.
2. Build & pass: replace the Download artifact step with your own build step(s) that produce the artifact on disk, then set artifact-name/artifact-path to the built file.

artifact-path must be a concrete file path — the action's internal [ -f ] check does not expand globs. A missing or incorrect path fails the job.

Placeholders to fill in before merging

Placeholder	Description
my-artifact	Set artifact-name to the artifact name used in your upload-artifact step (option 1) or the name you assign to your locally-built artifact (option 2)
dist/my-artifact.tgz	Set artifact-path to the concrete file path of the artifact — no globs

Required org secrets

• RLSECURE_LICENSE, RLSECURE_SITE_KEY
• SIGNAL_HANDLER_TOKEN, SIGNAL_HANDLER_DOMAIN
• PRODSEC_TOOLS_ARN, PRODSEC_TOOLS_USER, PRODSEC_TOOLS_TOKEN
• PRODSEC_PYTHON_TOOLS_REPO

🔮 Type of Change

• Standard

🔗 References

https://auth0team.atlassian.net/browse/SEPIO-1674

• I added at least one link (task, slack thread, etc) to explain why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.