docs: Add Snyk status badge to README.md

[terrytangyuan]

This is to draw attention to security issues. Snyk has been failing for a couple of days but we haven't noticed even before recent patch releases (example fix for a recent issue #12515 but the patch release is already out before this). https://github.com/argoproj/argo-workflows/actions/workflows/snyk.yml?query=branch%3Amain

[terrytangyuan]

Unrelated: license scan has been failing for a long time. @agilgur5 Could you take a look?

[agilgur5]

I asked in #12470 (comment), but is Dependabot just behind Snyk? Since it should auto-update on security vulns.

Although in the case of #12515, there is no way to auto-update since it was using the Argo fork of go-git

Also left 1 comment in-line

[agilgur5]

Unrelated: license scan has been failing for a long time. @agilgur5 Could you take a look?

This is waiting on Crenshaw (earlier Slack link) or someone else with existing FOSSA permissions to the Argoproj org, which I don't have

[terrytangyuan]

Unrelated: license scan has been failing for a long time. @agilgur5 Could you take a look?

This is waiting on Crenshaw (earlier Slack link) or someone else with existing FOSSA permissions to the Argoproj org, which I don't have

Can I remove the badge for now?

[terrytangyuan]

Yeah dependabot is not fast enough.

[terrytangyuan]

Removed CI badge

[agilgur5]

Can I remove the badge for now?

It impacts our CLOMonitor score per #12032. So it would trade one failing badge in favor of a lower score in another badge, which I don't think is ideal either 😕 . I'd much rather fix the root cause (though I don't have permissions to do that myself)

[terrytangyuan]

would trade one failing badge in favor of a lower score

How much lower?

[agilgur5]

How much lower?

I'm not sure from a quick check; it doesn't explicitly say in the docs (and I don't remember what it was beforehand), so I'd have to check its code to verify.

Per #12032, CNCF has focused efforts on getting CLOMonitor scores up for a few years now. I wouldn't want to intentionally regress those.
Ironically, relevant to this issue, per the PR I did try using Snyk for license scanning instead, but it does not fully support all our deps.
Also, as was mentioned on Slack, CD has had a failing license badge for even longer. It is currently still failing on CD's README

[agilgur5]

@terrytangyuan I got the license scan to pass now, see details in #12023 (comment) and further comments.
It's still not quite building daily / latest main and still needs transferring to Argoproj though; followed up in the Slack thread

[terrytangyuan]

Great to hear! Thanks!