ci(security): bump sonarqube-scan-action to v8.2.0 (Node 24)

.github/workflows/dependency-review.yml

@@ -12,5 +12,11 @@ jobs:
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           config-file: amazon-ospo/dependency-review-config/default/dependency-review-config.yml@8e4c9fdde54d2b7c6a3a28b97eddd26c4cd90a66 # main
-          # # distlib
-          # allow-dependencies-licenses: "pkg:pypi/distlib@0.4.0"
+          # SonarSource/sonarqube-scan-action is LGPL-3.0, which is not on the
+          # org's permissive-only allow-licenses list. It is a CI-only action we
+          # invoke in the pipeline — not code we distribute or link into the
+          # published plugins — so its copyleft terms do not reach our Apache-2.0
+          # output. Pinned to the exact SHA (= the dependency-review PURL version
+          # for a SHA-pinned action), so any future version bump re-triggers the
+          # license review rather than silently inheriting this exception.
+          allow-dependencies-licenses: "pkg:githubactions/SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e"

.github/workflows/security-scanners.yml

@@ -390,7 +390,7 @@ jobs:
           --url "http://localhost:9000/api/projects/create?project=my-project&name=MyProject" \
           --header 'Authorization: Bearer ${{ env.SONAR_TOKEN }}'
 
-    - uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+    - uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
       id: sonarqube-scan-action
       env:
         SONAR_HOST_URL: http://localhost:9000