Add FOSSA CI check

[jlebon]

See #65. Colin pointed to https://github.com/fossas/fossa-action.

[cgwalters]

One option is to do stuff like this organization-wide. It would help us keep things in sync more.

I was kind of thinking of having a meta-action in https://github.com/bootc-dev/actions that could then become an organization-required workflow.