fix(ci): pin osv-scanner reusable workflow to v2.3.5

The @v2 ref doesn't exist as a tag on google/osv-scanner-action — only full semver tags do. This was causing the CI workflow to fail at parse time with a 'workflow file issue' error before any job could run.

Author: theagenticguy

.github/workflows/ci.yml

@@ -76,7 +76,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.5
     with:
       scan-args: |-
         --lockfile=pnpm-lock.yaml