chore: pin osv-scanner

The `ghcr.io/google/osv-scanner:latest` docker image was updated to `v2.0.0-beta1`.
This breaks the build with the error:
`Failed to parse SBOM "/bom.json" with error: could not determine extractor suitable to this file`

This commit pins the image tag to last working release `v1.9.2`

Signed-off-by: Andrew Coleman <andrew_coleman@uk.ibm.com>

.github/workflows/pr.yml

@@ -69,7 +69,7 @@ jobs:
         with:
           name: cyclonedx-sbom
       - name: Scan
-        run: docker run --rm -v "${PWD}/${{ matrix.project }}/build/reports/bom.json:/bom.json" ghcr.io/google/osv-scanner --sbom /bom.json
+        run: docker run --rm -v "${PWD}/${{ matrix.project }}/build/reports/bom.json:/bom.json" ghcr.io/google/osv-scanner:v1.9.2 --sbom /bom.json
   java:
     name: Build and Test Java
     runs-on: ubuntu-latest
@@ -112,7 +112,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macOS-latest]
+        os: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
       with: