Bump Trivy to Uncompromised Version

[GA-XavierGonzalez]

Trivy has had a security compromise. Versions older than v0.35.0 are pointing to a malicious commit.
GHSA-69fq-xp46-6x23

This PR bumps the action to a safe version

[omad]

Heads up, this is good for now, but, it's much safer to pin any third party actions by SHA checksum instead of version tags. Version tags can, (and frequently do) get changed by attackers and there have been several instances of it happening in the last year.

See: https://wellarchitected.github.com/library/application-security/recommendations/actions-security/#pin-versions-of-actions

There's conflicting information floating around, but I believe dependabot does support updating pinned actions versions of the format:

    uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0

There's tools that can automate the conversion. There's none in particular I'd recommend, just pick one.

Cheers 😁