chore: update pvtr plugin to v0.24.0+2fixes

[joanagmaia]

Summary

• Bumps pvtr-github-repo-scanner commit from c7bd9538 (v0.23.2) to c1095c95 (post-v0.24.0 HEAD)
• Includes two required bug fixes: fix(OSPS-BR-07.01) (consult Security Insights when security_and_analysis is null) and fix(OSPS-LE-02.01) (pass deprecated but OSI/FSF-approved SPDX IDs)
• Updates plugin build stage from golang:1.26.3-alpine3.23 to golang:1.26.4-alpine3.22 — required by go.mod at new commit (go 1.26.4); matches pvtr's own Dockerfile
• Privateer binary stays at 0.21.2 (confirmed compatible)

No breaking changes

All commits between v0.23.2 and the new HEAD are dependency bumps, CI fixes, and the two bug fixes above.

🤖 Generated with Claude Code

---

Note

Low Risk
Docker-only dependency pin and toolchain bump for the security scanner plugin; no application code changes and behavior is limited to more accurate OSPS evaluation.

Overview
Bumps the Privateer GitHub repo scanner baked into Dockerfile.security_best_practices_worker: PVTR_VERSION moves to v0.24.0 and PVTR_COMMIT to c1095c95 (post-v0.24.0), replacing the v0.23.2 pin. That commit carries OSPS-BR-07.01 (use Security Insights when security_and_analysis is null) and OSPS-LE-02.01 (accept deprecated but OSI/FSF-approved SPDX license IDs).

The plugin build stage switches from golang:1.26.3-alpine3.23 to golang:1.26.4-alpine3.22 to match the scanner’s go.mod at the new commit. The Privateer core binary stays at 0.21.2.

^{Reviewed by Cursor Bugbot for commit 01742f6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[Copilot]

Pull request overview

This PR bumps the pvtr-github-repo-scanner plugin used by the security_best_practices_worker image from the v0.23.2 pin (commit c7bd9538) to a post-v0.24.0 commit (c1095c95, labeled "v0.24.0+2fixes"), which pulls in two required OSPS bug fixes. The change is isolated to a single build Dockerfile and involves no application code. I verified the change against the upstream scanner repo at the pinned commit: its go.mod declares go 1.26.4 and its own Dockerfile uses golang:1.26.4-alpine3.22 (digest-pinned), so the base-image change and version bump are correct and consistent. No other references to the old version or commit exist elsewhere in the repo.

Changes:

• Bump PVTR_VERSION to v0.24.0 and PVTR_COMMIT to c1095c95…, updating the accompanying comment to match.
• Update the plugin build stage base image from golang:1.26.3-alpine3.23 to golang:1.26.4-alpine3.22 (matches upstream go 1.26.4 requirement).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.