ci(fossa): use custom fossa config

A follow-up to https://github.com/spinframework/spin/pull/3138 which added a FOSSA check to CI.

The check is running successfully but it does encounter errors attempting to check some template apps under templates/ which would be nice to avoid. We'd like to exclude scanning these template apps via a .fossa.yml configuration file, eg:

version: 3

paths:
  exclude:
    - ./templates/**

However, in our tests, we encountered error(s) seemingly from some interaction with the fossa GH action (and/or fossa CLI) and the config. Example from this run:

/opt/hostedtoolcache/fossa/3.10.8/linux_amd64/fossa analyze 
Error:  An issue occurred

  *** Relevant Errors ***

      Error: Invalid project permission
      You do not have permission to edit projects for your Organization.
      Documentation: https://docs.fossa.com/docs/role-based-access-control
      Support: If you believe this to be a defect, please report a bug to FOSSA support at https://support.fossa.com/
      Help: Contact your FOSSA organization admin to grant you proper permissions

We've contacted support but have yet to hear back as of writing.

Start with the FOSSA check added in pull request 3138 and reproduce the linked CI run using a .fossa.yml configuration. Check how the FOSSA GitHub action or CLI handles the paths.exclude entry for templates/. Done means template apps are excluded from scanning and CI completes without the reported project-permission error.