ci(security): consolidate Trivy into manual pre-merge Security scan workflow - #656

…orkflow

Replace trivy.yml with a single security-scan.yml that can be run
manually on a PR branch before merging (workflow_dispatch), runs
automatically on main pushes and weekly on schedule (CVE drift), but
does NOT run on every pull_request push - intermediate commits in a PR
no longer trigger the heavy scan pipeline.

Jobs (all self-hosted, timeout-minutes set):

- build-image: docker build of the PR tree without publishing
  (push:false, load:true), exported via an artifact (docker save)
  so nothing unreviewed ever reaches ghcr and scan-image works
  regardless of which runner in the pool picked the job
- scan-fs / scan-config: Trivy fs and misconfig scans with the
  existing trivy.yaml/.trivyignore
- scan-image: Trivy image scan of the locally loaded artifact image
- scan-result: aggregate job (needs all, if: always()) that fails if
  any scan failed or was skipped - this is the check to mark as
  required in branch protection

Branch protection (manual, admin): require Test, Loadtest, DCO and
scan-result, with 'Require branches to be up to date before merging'
enabled. scan-result stays 'expected' on a PR until someone runs the
workflow on its head SHA; a new commit after a run requires re-running.

Fork PRs are expected to be merged via admin bypass, since
workflow_dispatch cannot run on fork branches (accepted trade-off).

Signed-off-by: pirog-spb <[email protected]>

Address the CodeQL actions alerts on security-scan.yml: jobs without
an explicit permissions block inherit the repository default GITHUB_TOKEN
permissions, which are usually broader than needed.

- workflow level: contents: read (checkout only)
- scan-image: {} - same-run artifact download uses ACTIONS_RUNTIME_TOKEN,
  docker load and trivy image scan are local operations
- scan-result: {} - pure shell job
- build-image: drop the job-level block, now covered by the workflow-level
  default

Signed-off-by: pirog-spb <[email protected]>