chore: Add blackduck scans to our pipeline

[tomfrenken]

This PR adds blackduck to our pipeline, check out my fork to see how it works.

In Blackduck, each version is determined by the module version in Lerna and the github_ref_name, aka. the branch name.
So the main branch will look like 1.57.2-main while branches may look like 1.57.2-my-branch.

Additionally, it doesn't scan devDependencies.

Closes SAP/cloud-sdk-backlog#549.

[tomfrenken]

The refs seem to be 2081/merge instead of the branch's name 🤔

[tomfrenken]

I guess the PR number is just as sufficient, so no problem imo.

[jjtang1985]

Have you created some negative tests so we know the PRs can be blocked when positive findings are detected?

[tomfrenken]

Have you created some negative tests so we know the PRs can be blocked when positive findings are detected?

Before I excluded the dev dependencies the pipeline on my fork was failing, I guess I could try out another productive dependency to make sure it also fails on regular dependencies.

[tomfrenken]

While testing blackduck on my fork, I've had 3 findings:

1. After adding a vulnerable dependency, which had a severity of high according to dependabot alerts, Blackduck did not deem the dependency a security risk.
2. After adding my own test package with a proprietary license, it wasn't always detected by Blackduck, so somewhat flaky.
3. Blackduck sometimes had performance issues, roughly 3-4/66 so about 5% of my runs were stuck.

[florian-richter]

Looks good!

[florian-richter]

Should we add a comment or follow up ticket to change this to main once we merge 2.0 into it?

[tomfrenken]

Yeah good point, perhaps we should add it to whatever ticket we have to switch the default branch back to main.