Move osv-scanner to v2.7.0

[vvillait88]

Summary

Moves the dependency scan's pinned osv-scanner binary from v2.6.0 to v2.7.0, the latest release, in .github/workflows/security.yml. Dependabot does not track a binary downloaded by URL, so the version is updated by hand. The release asset name (osv-scanner_linux_arm64) is unchanged.

The package's dependencies are already current: every outdated row is either a held major (eslint 10, TypeScript 7) or a release still inside the 24h minimum release age.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. Only a CI workflow input changes, so nothing ships.

Test plan

The Dependency Scan job on this PR downloads and runs v2.7.0. Locally, osv-scanner 2.7.0 scans this repo's lockfile clean.

Checklist

• Tests cover the new behavior, and the suite passes locally (no behavior change; CI is the check)
• Lint, format, and type checks pass (no source change; CI is the check)
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests