feat: Add Scanner CI runner and related artifacts

- Implemented `run-scanner-ci.sh` to build and run tests for the Scanner solution with a warmed NuGet cache.
- Created `excititor-vex-traces.json` dashboard for monitoring Excititor VEX observations.
- Added Docker Compose configuration for the OTLP span sink in `docker-compose.spansink.yml`.
- Configured OpenTelemetry collector in `otel-spansink.yaml` to receive and process traces.
- Developed `run-spansink.sh` script to run the OTLP span sink for Excititor traces.
- Introduced `FileSystemRiskBundleObjectStore` for storing risk bundle artifacts in the filesystem.
- Built `RiskBundleBuilder` for creating risk bundles with associated metadata and providers.
- Established `RiskBundleJob` to execute the risk bundle creation and storage process.
- Defined models for risk bundle inputs, entries, and manifests in `RiskBundleModels.cs`.
- Implemented signing functionality for risk bundle manifests with `HmacRiskBundleManifestSigner`.
- Created unit tests for `RiskBundleBuilder`, `RiskBundleJob`, and signing functionality to ensure correctness.
- Added filesystem artifact reader tests to validate manifest parsing and artifact listing.
- Included test manifests for egress scenarios in the task runner tests.
- Developed timeline query service tests to verify tenant and event ID handling.

src/ExportCenter/StellaOps.ExportCenter.RiskBundles/RiskBundleModels.cs

@@ -0,0 +1,43 @@
+using System.Text.Json.Serialization;
+
+namespace StellaOps.ExportCenter.RiskBundles;
+
+public sealed record RiskBundleProviderInput(
+    string ProviderId,
+    string SourcePath,
+    string Source,
+    bool Optional = false,
+    DateOnly? SnapshotDate = null);
+
+public sealed record RiskBundleProviderEntry(
+    string ProviderId,
+    string Source,
+    DateOnly? SnapshotDate,
+    string Sha256,
+    long SizeBytes,
+    bool Optional,
+    string BundlePath,
+    string SourceFilePath,
+    string? SignaturePath);
+
+public sealed record RiskBundleManifest(
+    string Version,
+    Guid BundleId,
+    DateTimeOffset CreatedAt,
+    IReadOnlyList<RiskBundleProviderEntry> Providers,
+    string InputsHash);
+
+public sealed record RiskBundleBuildRequest(
+    Guid BundleId,
+    IReadOnlyList<RiskBundleProviderInput> Providers,
+    string? BundleFileName = null,
+    string BundlePrefix = "risk-bundles",
+    string ManifestFileName = "provider-manifest.json",
+    string ManifestDsseFileName = "provider-manifest.dsse",
+    bool AllowMissingOptional = true);
+
+public sealed record RiskBundleBuildResult(
+    RiskBundleManifest Manifest,
+    string ManifestJson,
+    string RootHash,
+    MemoryStream BundleStream);