ci: add Trivy security scan workflow

[sgrams]

Summary

Add a GitHub Actions workflow for Trivy security scanning with two parallel jobs:

• Filesystem vulnerability scan — scans Cargo.lock and dependencies for known CVEs (CRITICAL, HIGH severity)
• Config & IaC scan — checks GitHub Actions workflows and configuration files for misconfigurations (CRITICAL, HIGH, MEDIUM severity)

Refers to #368

Details

• Results are uploaded as SARIF to the GitHub Security tab (Code scanning alerts), alongside existing CodeQL findings
• External vendored code (external/) is excluded via skip-dirs
• The pre-build.sh patch script runs before the fs scan so Cargo.lock is accurate
• Triggers: push/PR to main + weekly cron (Monday 06:00 UTC)
• All action references are pinned by SHA, consistent with the existing repo convention
• Uses aquasecurity/trivy-action@v0.35.0 (latest, post-supply-chain-attack re-tag)

Complements existing security tooling

Tool	Coverage
cargo-deny	License, bans, advisories for Cargo deps
CodeQL	Static analysis (Python)
Scorecard	Supply-chain security posture
Dependabot	Automated dependency updates
Trivy (new)	CVE scanning + workflow/config misconfiguration detection

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.