This PR moves the FOSSA check from the Node workflow to its own. It won't run if the API key secret is not present (which would be true when running PRs from forks).
In addition, the check
1. will only run on changes to any `package.json` in the monorepo
2. runs `fossa test` to fail upon failure (previously it would only fail upon _error_)
FOSSA was giving us a bunch of warnings about copyleft licenses, but these licenses are only present in our examples. This configuration file will tell FOSSA to ignore that stuff.
FOSSA recognizes `examples/` as something it should skip, but not `sample-code`. It's easier to rename the dir than it is to negotiate a PR with FOSSA. Why they don't allow the config file to just ignore directories is beyond me...
