update pipeline definition

add build-step log to component-descriptor
for SAST scans. Also add label to component-descriptor
indicating we use (although logs are currently
only appended on release)

.ci/pipeline_definitions

@@ -1,5 +1,12 @@
 terraformer:
   base_definition:
+    repo:
+      source_labels:
+        - name: cloud.gardener.cnudie/dso/scanning-hints/source_analysis/v1
+          value:
+            policy: skip
+            comment: |
+              we use gosec for sast scanning. See attached log.
     traits:
       version:
         preprocess: 'inject-commit-hash'
@@ -146,6 +153,17 @@ terraformer:
           ocm_repository: europe-docker.pkg.dev/gardener-project/releases
         release:
           nextversion: 'bump_minor'
+          assets:
+          - type: build-step-log
+            step_name: verify
+            purposes:
+            - lint
+            - sast
+            - gosec
+            comment: |
+              we use gosec (linter) for SAST scans
+              see: https://github.com/securego/gosec
+              enabled by https://github.com/gardener/terraformer/pull/158
         slack:
           default_channel: 'internal_scp_workspace'
           channel_cfgs: