This adds SECURITY.md and a scanning workflow, using Trivy. In
particular, this clarifies what we use to scan for vulnerabilities
(Trivy, not anything else), and the only channel likely to be responded
to on a significant issue (zipkin-admin email, not advisories as people
ignored them).

---------

Signed-off-by: Adrian Cole <[email protected]>

newBody was called twice which would result in encoding the list of
spans twice unnecessarily. This change will reduce allocations and
copying memory.

Routine dependency updates

Signed-off-by: Andriy Redko <[email protected]>