Add Trivy vulnerability scanning for Docker images

[vharseko]

Adds Docker image vulnerability scanning with Trivy, ported from OpenIdentityPlatform/OpenDJ#854.

build.yml — both build-docker and build-docker-alpine jobs now scan the freshly built image (resolved from the local Docker daemon, so the runner's linux/amd64 manifest only) right after the functional docker test. Findings do not fail the build: the SARIF report is uploaded via codeql-action/upload-sarif, so PRs get a "Code scanning results / trivy-build-*" check like CodeQL and the full list lives in the Security tab. Only fixable CRITICAL/HIGH CVEs are reported (ignore-unfixed: true plus limit-severities-for-sarif: true — without the latter the severity filter is silently dropped for SARIF output), and only the vulnerability scanner runs (scanners: vuln). The action's built-in ~1GB DB cache is disabled (cache: false) so it cannot evict the m2-repository caches out of the repo's 10GB actions-cache quota. The two docker jobs get security-events: write; SARIF upload also works for fork PRs on public repositories.

docker-scan.yml (new) — weekly cron (30 5 * * 1) + workflow_dispatch scan of the published openidentityplatform/openidm:latest and :alpine images (both present on Docker Hub, last pushed 2026-07-22): new CVEs surface in already-released images (mostly via the base image) without any change in this repository. Unlike the build-time scan, unfixed CVEs are reported too — surfacing them in released images is the point. Reports are uploaded as SARIF to the Security tab with a separate category per tag (trivy-image-*, distinct from the trivy-build-* categories in build.yml). The scheduled run is skipped in forks; manual runs are always allowed.

aquasecurity/trivy-action is pinned by commit SHA (ed142fd0… = v0.36.0, verified against the tag). Future false positives / accepted findings can be suppressed via a .trivyignore file in the repository root or dismissed in the Security tab.

Differences from the OpenDJ change are limited to the repository/image names; OpenIDM's docker jobs keep their registry:2 service and have no JMeter step, so nothing else was touched. Note: #206 also edits build.yml (workflow-level permissions and action pins) in different hunks — whichever lands second may need a trivial rebase.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.