New ignore file and reworked fossid workflow to reduce false positives

[danielsoden0404]

In this change I used a script to generate a list of ids of open source Gerrit repos to ignore and included the rdkcentral and rdkcmf ignore wildcards.

I also reworked the workflow file according to advice from fossid in that the image we should be using is fossid-toolbox for diffscan, not fossid-cicd. From here I adjusted some of the flags accordingly

[Copilot]

Pull request overview

This PR updates the FossID pre-merge diff scan setup to reduce false positives by switching to the recommended fossid-toolbox image/CLI and replacing the previous ignore-file approach with a generated ignore list.

Changes:

• Added a generated ignored_projects_list containing Gerrit OSS project IDs and GitHub org wildcards to ignore.
• Removed the older ignore_projects_fossid ignore file.
• Reworked the FossID GitHub Actions workflow to use quay.io/fossid/fossid-toolbox and updated CLI flags/file paths accordingly.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
ignored_projects_list	Introduces the new generated ignore list used to reduce false positives.
ignore_projects_fossid	Deletes the previous ignore file in favor of the new list.
.github/workflows/fossid_integration_stateless_diffscan.yml	Switches workflow execution to fossid-toolbox/fossid diffscan and updates ignore-projects handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This checkout pulls from rdkcentral/build_tools_workflows without providing a token. In this repo, other workflows use ${{ secrets.RDKCM_RDKE }} when checking out rdkcentral/build_tools_workflows, and without a token this step can fail (private repo) or hit stricter rate limits. Consider adding a token: input (or making it a required secret for this workflow) for consistency and reliability.

[Copilot]

This repository now includes an ignored_projects_list file at the repo root, but the workflow ignores it and instead checks out tools/ignored_projects_list from rdkcentral/build_tools_workflows@develop. This can lead to the checked-in list going stale/confusing. Either remove the root file, or update the workflow to use the in-repo list (and drop the extra checkout) so there is a single source of truth.

[mhughesacn]

1. Copilot has a comment about ignored_projects_list being in two different places.  Checked in at top level but the yml workflow uses tools/ignored_project_list - is this OK?
2. Also there is a duplicate in the ignore file - Copilot again.
3. Can the last two entries in the ignore file go on top as extra entries will likely be appended?
4. The ignores are just magic numbers as required by fossid. It would be good to include the URLs as well - is a comment possible (?) and if not, to have the projects in a separate file also checked in here.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.