Migrate from tfsec to trivy config

[DuqueOM]

Context

tfsec was archived by aquasecurity. We've pinned to v1.28.14 as a workaround (see CHANGELOG [Unreleased] and .github/workflows/validate-templates.yml).

The official successor is trivy config, which is already used for container scanning in the template.

Acceptance Criteria

• Replace tfsec install + execution steps in .github/workflows/validate-templates.yml with trivy config
• Migrate .security-baselines/tfsec.yml to trivy config format (or consolidate with existing trivy baseline)
• Update templates/cicd/ci-infra.yml (scaffolder template) to use trivy config instead of tfsec
• Verify all existing tfsec checks pass with trivy config
• Update CHANGELOG and any references in docs/

References

• tfsec archival: docs: iniernet -> internet Typo aquasecurity/tfsec#2059
• trivy config docs: https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/
• Current workaround: commit 5faad81 (tfsec pinned to v1.28.14)

Priority

Medium — current workaround is stable, but tfsec will receive no further updates.