Add SCANOSS baseline workflow

* introduce GitHub Actions workflow
`.github/workflows/scanoss-license-check.yml`
* run SCANOSS code scan without policies for baseline collection
* save raw results as artifact `scanoss-baseline-results`

Author: jfaltermeier

.github/workflows/scanoss-license-check.yml

@@ -0,0 +1,38 @@
+name: SCANOSS PR Scan
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  #  pull-requests: write
+  checks: write
+  actions: read
+
+jobs:
+  baseline:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run SCANOSS
+        id: scan
+        uses: scanoss/code-scan-action@4203cc83ec5675e190bb0a412e5404dd044efa30 # v1.0.6
+        with:
+          dependencies.enabled: false
+          policies: undeclared
+          policies.halt_on_failure: true
+          scanossSettings: true
+          settingsFilepath: .scanoss.json
+
+      - name: Save raw results
+        run: |
+          echo "Results at: ${{ steps.scan.outputs.result-filepath }}"
+          cp "${{ steps.scan.outputs.result-filepath }}" scanoss-results.json
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: scanoss-baseline-results
+          path: scanoss-results.json

.scanoss.json

@@ -0,0 +1,41 @@
+{
+  "self": {
+    "name": "theia-cloud",
+    "license": "EPL-2.0",
+    "description": "SCANOSS configuration for Theia Cloud"
+  },
+  "settings": {
+    "skip": {
+      "patterns": {
+        "scanning": [
+          "**/node_modules/",
+          "**/dist/",
+          "**/build/",
+          "**/target/",
+          "**/*.min.*",
+          "**/*.generated.*",
+          "**/*.graphml",
+          "**/*.vsix",
+          "documentation/**"
+        ],
+        "fingerprinting": ["*.log", "*.tmp", "**/*test*.*"]
+      }
+    }
+  },
+  "bom": {
+    "include": [
+      { "purl": "pkg:github/eclipsesource/theia-cloud" },
+      { "purl": "pkg:github/eclipse-theia/theia-cloud" },
+      { "purl": "pkg:npm/%40eclipse-theiacloud/common" },
+      { "purl": "pkg:npm/theiacloud-test" }
+    ],
+    "remove": [
+      {
+        "path": "demo/dockerfiles/demo-theia-monitor-vscode/theia-cloud-monitor-1.1.1.vsix",
+        "purl": "pkg:github/eclipse-theia/theia-cloud",
+        "comment": "Build artifact; suppress baseline finding"
+      }
+    ],
+    "replace": []
+  }
+}