fix(ci): osv-scanner binary must be _linux_arm64 (Blacksmith runners are ARM)

The previous _linux_amd64 download silently exec-failed; the prior
`|| true` masked it. Now that the swallow is removed, the architecture
mismatch surfaces. Blacksmith pool is ARM, osv-scanner publishes both
_amd64 and _arm64 binaries — switching to the right one.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vvillait88

.github/workflows/security.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.3.5/osv-scanner_linux_amd64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.3.5/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies