ci: run SCA scan on runner with JDK 17 and Android SDK

The snyk/actions/gradle container has no Android SDK and its Gradle 8.5
init script fails, so snyk.json was never written. Set up JDK and the
Android SDK on the runner and run the Snyk CLI there instead.

Refs DX-20927

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: reeshika-h

.github/workflows/sca-scan.yml

@@ -10,12 +10,34 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@master
-      - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/gradle@master
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          cache: 'gradle'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+        with:
+          packages: 'platform-tools platforms;android-34 build-tools;34.0.0'
+
+      - name: Setup local.properties
+        run: |
+          cat << EOF >> local.properties
+          sdk.dir=$ANDROID_HOME
+          EOF
+
+      - name: Set up Snyk
+        uses: snyk/actions/setup@master
+        with:
+          snyk-version: latest
+
+      - name: Run Snyk
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --fail-on=all --all-sub-projects
-          json: true
+        run: snyk test --fail-on=all --all-sub-projects --json > snyk.json
         continue-on-error: true
-      - uses: contentstack/sca-policy@main
+
+      - uses: contentstack/sca-policy@main