website: add ossrisk to ecosystem (#8780)

## What

Adds [ossrisk](https://github.com/depkeep/ossrisk) to the OPA ecosystem
page.

ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency
trees for supply-chain and long-term viability risk: known CVEs (via
OSV.dev), end-of-life versions, abandonment signals, typosquatting,
license compliance, and maintainer-takeover patterns.

Beyond a `--fail-on <severity>` threshold, ossrisk integrates with OPA
via the `opa` CLI: the scan result JSON is passed as `input` to `opa
eval`, and policies in `package ossrisk` add messages to a `deny` set to
gate the build. This enables cross-signal rules a threshold alone cannot
express — for example blocking packages with install scripts published
by a brand-new maintainer (the event-stream takeover pattern). The JSON
output also pipes cleanly into conftest.

## Changes

- `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category:
security`, `layer: cicd`, `type: poweredbyopa`
- `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo

---------

Signed-off-by: glimm-no <admin@glimm.no>
Signed-off-by: pkuzco <b.naamneh@gmail.com>
Co-authored-by: glimm-no <admin@glimm.no>
Co-authored-by: Charlie Egan <git@charlieegan3.com>

docs/src/data/ecosystem/entries/ossrisk.md

@@ -0,0 +1,31 @@
+---
+title: ossrisk
+subtitle: Dependency supply-chain risk scanner with Rego policy gates
+labels:
+  category: security
+  layer: cicd
+  type: poweredbyopa
+inventors:
+- depkeep
+code:
+- https://github.com/depkeep/ossrisk
+tutorials:
+- https://github.com/depkeep/ossrisk#policy-as-code-opa
+software:
+- npm
+- pypi
+- github-actions
+---
+
+ossrisk scans npm and PyPI dependency trees for supply-chain and long-term
+viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment
+signals, typosquatting, license compliance, maintainer-takeover patterns, and
+install scripts.
+
+Beyond a simple `--fail-on <severity>` threshold, ossrisk delegates gating
+decisions to OPA. The scan result is passed to `opa eval` as `input`; policies
+live in `package ossrisk` and add human-readable messages to a `deny` set, and
+any violation fails the scan. This enables cross-signal rules a severity
+threshold cannot express - for example "no strong-copyleft licenses in direct
+dependencies" or "block packages that add install scripts under a brand-new
+publisher" (the event-stream takeover pattern).

docs/static/img/ecosystem-entry-logos/ossrisk.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
+  <circle cx="50" cy="50" r="50" fill="#16a34a"/>
+  <svg x="18" y="18" width="64" height="64" viewBox="-1.5 -1.5 27 27" fill="none" stroke="#ffffff" stroke-width="2.5" stroke-linecap="round" preserveAspectRatio="xMidYMid meet">
+    <line x1="6" y1="3" x2="6" y2="21"/>
+    <line x1="6" y1="12" x2="18" y2="4"/>
+    <line x1="6" y1="12" x2="18" y2="20"/>
+    <circle cx="6" cy="3" r="2"/>
+    <circle cx="6" cy="12" r="2"/>
+    <circle cx="6" cy="21" r="2"/>
+    <circle cx="18" cy="4" r="2"/>
+    <circle cx="18" cy="20" r="2"/>
+  </svg>
+</svg>