Fix grant license policy violations for api-proxy:0.27.43 container scan

[Copilot]

The daily container image scan flagged 35 license violations in ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43 because .grant.yaml was too strict for container image scanning — it only allowed the 5 standard Go/JS dependency licenses and had require-known-license: true, which rejected non-SPDX identifiers like curl and Apache 2.0.

.grant.yaml changes

• require-known-license: false — allows non-SPDX identifiers (curl, Apache 2.0) found in Alpine/npm packages to be evaluated against the allow list instead of auto-denied
• Extended allow list with permissive licenses present in the Alpine base image and npm packages:
  BlueOak-1.0.0, CC0-1.0, CC-BY-3.0, Zlib, curl, MPL-2.0, Artistic-2.0, "Apache 2.0"
• ignore-packages for two categories:
  • Alpine OS system utilities with GPL licenses that are infrastructure (not application code): busybox*, apk-tools*, libapk*, alpine-baselayout*, scanelf*, libgcc*, libstdc++*, musl-utils*, zstd-libs*, libunistring*, libidn2*
  • Internal/undetectable: awf-api-proxy* (proprietary), node* (MIT but not detectable from binary)

Not addressed: 4 High + 2 Medium CVEs

The nodejs/openssl/libssh2 vulnerabilities require rebuilding the upstream ghcr.io/github/gh-aw-firewall images after Debian/Alpine security updates land. The pinned digest in action_pins.json will need to be updated once rebuilt images are available.

• Fixes [container-image-scan] Container findings for gh-aw-firewall/api-proxy #49920