add security-insights.yml

[zhzhuang-zju]

What type of PR is this?
/kind documentation

What this PR does / why we need it:
provide an OpenSSF Security Insights manifest file.

Which issue(s) this PR fixes:
Parts of #5048

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 28.25%. Comparing base (8736fae) to head (7a55f03).
Report is 2 commits behind head on master.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5140   +/-   ##
=======================================
  Coverage   28.25%   28.25%           
=======================================
  Files         632      632           
  Lines       43722    43722           
=======================================
  Hits        12353    12353           
  Misses      30467    30467           
  Partials      902      902           

Flag	Coverage Δ
unittests	28.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[RainbowMango]

Who will use this security insight and how?

[zhzhuang-zju]

Who will use this security insight and how?

Security-insights.yml provides a mechanism for projects to report information about their security in a machine-processable way. It is formatted as a YAML file to make it easy to read and edit by humans. And more info can refer to https://github.com/ossf/security-insights-spec

[RainbowMango]

Suggested change

	tool-version: 'v0.52.2'
	tool-version: 'v0.52.3'

[RainbowMango]

/approve

@liangyuanpeng Do you want to take another look?
This file is required by CLOMonitor, but to be honest I'm not sure who will benefit from this. Just follow the CLOMonitor instructions.

[karmada-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liangyuanpeng]

Just follow the CLOMonitor instructions.

/lgtm