buildah: ignore tests and vendor directories

[siteshwar]

Related: https://openscanhub.fedoraproject.org/task/22700/

[siteshwar]

@lsm5 Would it be possible for you to review this pull request? There has been significant amount of warnings generated for tests. Scanning these tests should be disabled unless upstream plans to fix them.

[siteshwar]

However, there have been several fixes made in tests due to reports from OpenScanHub:

containers/buildah#6023 (comment)
containers/buildah#5841 (comment)
containers/buildah#6126 (comment)

[siteshwar]

@lsm5 All of these findings are from shellcheck. It would be more useful to directly enable differential shellcheck in upstream to catch these warnings automatically. I am going to merge this pull request.

[lsm5]

@lsm5 All of these findings are from shellcheck. It would be more useful to directly enable differential shellcheck in upstream to catch these warnings automatically. I am going to merge this pull request.

Ack, I guess we can't control much the stuff in buildah/vendor/ but something can (and should) be done about the test scripts. Differential shellcheck sgtm. @nalind @flouthoc wdyt?

[siteshwar]

@lsm5 I would go further to suggest you to disable osh-diff-scan check in upstream. We are not scanning Go code yet. So, scan results would be empty. However, you would still see the results during mass scans.