chore(security): extend license allowlist with BSL-1.0, CC0-1.0, 0BSD (#22)

Adds three permissive SPDX identifiers to the allowlist in both
`.github/workflows/security.yml` (the enforced gate) and `SECURITY.md`
(the documented policy):

- `0BSD` — Zero-Clause BSD. Rare but real.
- `BSL-1.0` — Boost Software License (permissive, OSI-approved). Not
  the source-available Business Source License (BUSL/BSL on the
  denylist); SECURITY.md now spells the distinction out so future
  exception requests do not get triggered by the name collision.
- `CC0-1.0` — public-domain dedication, common in small Go utilities.

Switches the allowlist ordering to ASCII-sorted by SPDX id and pins
that ordering with a comment in security.yml, so the workflow env and
SECURITY.md stay in sync on future edits.

Withings-export-cli carries the same workflow copy; a parallel PR
mirrors the change there. crono- and liftoff-export-cli have not
onboarded the workflow yet and are out of scope for this PR.

Refs QUA-46.

Co-authored-by: LeadGoEngineer <[email protected]>
Co-authored-by: Paperclip <[email protected]>

Author: 3 people

.github/workflows/security.yml

@@ -99,8 +99,9 @@ jobs:
       contents: read
     env:
       # Policy: every direct + transitive Go dep must resolve to one of these SPDX ids.
+      # Keep this list sorted by SPDX id; SECURITY.md "License allowlist" must match exactly.
       # See SECURITY.md "Supply-chain policy" for the rationale.
-      ALLOWED_LICENSES: "Apache-2.0,MIT,BSD-2-Clause,BSD-3-Clause,MPL-2.0,ISC,Unlicense"
+      ALLOWED_LICENSES: "0BSD,Apache-2.0,BSD-2-Clause,BSD-3-Clause,BSL-1.0,CC0-1.0,ISC,MIT,MPL-2.0,Unlicense"
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

SECURITY.md

@@ -46,20 +46,23 @@ Every PR — in `common` and in every `*-export-cli` — is gated on a CI workfl
 - `osv-scanner` for transitive vulnerabilities across the OSV database.
 - A license-policy check that allowlists only permissive licenses.
 
-**License allowlist** (SPDX identifiers):
+**License allowlist** (SPDX identifiers, sorted by SPDX id; must match `ALLOWED_LICENSES` in `.github/workflows/security.yml` exactly):
 
+- `0BSD`
 - `Apache-2.0`
-- `MIT`
 - `BSD-2-Clause`
 - `BSD-3-Clause`
-- `MPL-2.0`
+- `BSL-1.0` (Boost Software License — permissive, OSI-approved; **not** the source-available Business Source License — see denylist entry for `BUSL-*`)
+- `CC0-1.0`
 - `ISC`
+- `MIT`
+- `MPL-2.0`
 - `Unlicense`
 
 **License denylist** (blocking; not exhaustive):
 
 - The GPL family — `GPL-*`, `LGPL-*`, `AGPL-*`.
-- `SSPL-*`, `BUSL-*` / `BSL-*`, and other "source-available" licenses.
+- `SSPL-*`, `BUSL-*` (Business Source License — sometimes informally written "BSL"; not to be confused with the permissive `BSL-1.0` Boost above), and other "source-available" licenses.
 - "Custom" or unidentified licenses where the SPDX identifier cannot be resolved.
 
 A PR that introduces a denied license is blocked. To request an exception, open an issue against `quantcli/common` with the dependency name, version, license text, and the rationale. Exceptions are rare and case-by-case.