[erikhortsch]

Adds .oss-scanner/Dockerfile and .oss-scanner/threat_model.md so this repo can be enrolled in Anthropic's OSS Scanner. Same layout as livekit/livekit#4995. Enrollment itself is a separate PR to anthropics/oss-scanner, which needs these files on the scanned branch.

The threat model scopes the scan to the hand-written Go (auth/, webhook/, datatrack/, sdp/, utils/decodebudget/, sip/, ...) and excludes generated code.

Verification

• tools/check from anthropics/oss-scanner against this branch: builds, scanner layer installs, image starts offline.
• In the built image with --network none --cpus 2 --memory 8g: go test ./... (37 packages ok), go test -race ./auth/..., and a 10s run of FuzzPacketUnmarshal all pass.
• Built on arm64 (podman); the scanner runs x86-64. The base image is multi-arch and nothing arch-specific is fetched.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: a383d87

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR