`fcli fod action run ci`: Automatically add --oss / --aviator options

[rsenden]

Enhancement Request

Similar to the Fortify GitHub Action, based on an environment variabele name like DO_DEBRICKED_SCAN or DO_SCA_SCAN (TBD, also see #705), automatically add the -oss packaging option, and --oss option on setup-release. Similar for an environment variable like DO_AVIATOR_AUDIT; this should automatically pass the appropriate option to setup-release.

[rsenden]

Based on further internal discussions, we should separate SAST and SCA scans:

• Running combined SAST+SCA scan on a ScanCentral package may result in false positives, due to Debricked fingerprinting of (irrelevant) files that are being included in the ScanCentral package
• Users can explicitly enable/disable the Debricked scan on a scan-by-scan basis, rather than re-using the existing SAST scan configuration, which may or may not have OSS scans enabled. For comparison, the ‘debricked-sca-scan: true|false’ setting on Fortify GitHub Action is only effective if not SAST scan settings exist on FoD yet; if SAST scan was previously configured, debricked-sca-scan won't override the existing settings.
• Better visibility on the two separate scans; if we request a combined SAST/OSS scan, I think FoD API only returns the scan id for the SAST scan, not for the Debricked scan, so we can’t explicitly track status of the OSS scan.
• More consistency with SSC implementation, where we also run Debricked scans separately from SAST scans.

For example, if DO_SCA_SCAN is set to true, we'd run the following commands (intermingled with existing SAST-related commands to provide least wait time):

• fcli tool definitions update
• fcli tool debricked-cli install
• fcli tool debricked-cli run -- resolve --> Point to/run in source dir
• fcli fod oss-scan start --> We need some way to package the output of debricked resolve into a zip file
• fcli fod oss-scan wait-for

It might be good to have a separate fcli action like debricked-scan that performs all of these steps above (with optional wait-for), then call the debricked-scan action from the ci action.