✨(ci) add security scan

[rouja]

Add a security scan for CVE with trivy

[Morendil]

I notice that the build jobs frequently fail with the following error message (reformatted for clarity):

2024-10-30T10:48:12Z	FATAL	Fatal error
  image scan error:
  scan error:
  scan failed:
  failed analysis:
  analyze error:
  pipeline error:
  failed to analyze layer (sha256:e4e85ef47ed5564337c653adcb6f9f3760ead021d1cd0691a29a1ac57fd6f5b0):
  post analysis error: Unable to initialize the Java DB:
  Java DB update failed: DB download error: oci download error:
  failed to fetch the layer:
  GET https://ghcr.io/v2/aquasecurity/trivy-java-db/blobs/sha256:a18f04a942e33d9ffd8cf1ab4d35a09f88936e0729cdd4171dea0aa15a0e457c:
  TOOMANYREQUESTS: retry-after: 80.883µs, allowed: 44000/minute

This is troublesome, we've been trying to reduce noise/instability in the build…

This is a known Trivy issue aquasecurity/trivy#7538

I don't think the issue this can be fixed within this PR, it will require changing the trivy action.

[Morendil]

Any particular reason to use run-name over name ? (I don't think this is a blocker for merging the PR but if there is a practical reason it might be useful to document it…)

[Morendil]

See #500 for a version of this PR without the fixes applied, showing the Trivy report with CVEs.

[Morendil]

After discussion with @mjeammet a good solution would be to make this an optional check in CI. Will look into that.

[Morendil]

Extracted the scan from build-and-push so an occasional failure for non-security reasons will not block from merging or require re-running jobs.