ci: add container image security scanning with Trivy

[nfvelten]

Migrated from nfvelten/arbitus#128

Summary

Docker images are now published to ghcr.io/nfvelten/arbitus. They are not scanned for OS-level CVEs or vulnerable packages. A single vulnerable Alpine or Debian package could introduce a critical CVE into the published image.

Implementation

Add to .github/workflows/docker.yml after the build step:

- name: Scan container image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'ghcr.io/nfvelten/arbitus:latest'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'   # fail build on critical/high CVEs

- name: Upload scan results
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: 'trivy-results.sarif'

References

• PROPOSAL.md §7.2