ci: report vulnerabilities and fail on HIGH,CRITICAL

[cjdcordeiro]

• Have you signed the CLA?

---

Problem

The current GH workflow runs the Trivy scan but doesn't react to its findings, exiting successfully even if there are vulnerabilities.

In this PR

This PR adds an additional Trivy execution that raises an error on HIGH and CRITICAL vulnerabilities. It also uploads the vulnerability report to the CI run and the GitHub Security dashboard (example)

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[cjdcordeiro]

@letFunny @rebornplusplus can we update the yaml module?

[cjdcordeiro]

needs #153 for CI to pass

[rebornplusplus]

@letFunny @rebornplusplus can we update the yaml module?

Should be alright, yeah. Following should do it:

go get gopkg.in/yaml.v3
go mod tidy

If you want to take this chance and update everything:

go get -u
go mod tidy

[rebornplusplus]

Oh, I see you raised #153 already!

[niemeyer]

Can't tell if this is actually doing what it should, but the theory sounds good.