Add "compliance" report

[trask]

Not sure if this is the right name for it, but the effort of implementing and passing them does sort of feel like compliance work.

We could add link to this from README once we get more repositories onboarded.

I'm currently working with CNCF folks to onboard to their FOSSA instance which has their own customized license checks. So far I've been using a FOSSA account created and tracked in #2556.

Here's an example of the work that was done in one of the Java repos related to this:

• [StepSecurity] ci: Harden GitHub Actions semantic-conventions-java#152
• [StepSecurity] ci: Harden GitHub Actions semantic-conventions-java#153
• Update renovate config to pin github action versions semantic-conventions-java#155
• Add OSSF scorecard workflow semantic-conventions-java#156
• Add CodeQL semantic-conventions-java#157
• Restrict token permissions semantic-conventions-java#161
• Add FOSSA license scanning semantic-conventions-java#163

[svrnm]

We should put those badges also into the README of the repository, if they are not there yet (I only checked android).

[trask]

We should put those badges also into the README of the repository, if they are not there yet (I only checked android).

oh, I missed android, thanks! open-telemetry/opentelemetry-android#816