Remove aquasecurity/trivy-action from .github/workflows/scan.yml

[julialawrence]

Why

aquasecurity/trivy-action has been compromised for the second time. All tags before 0.35.0 were re-pointed to a malicious commit that dumps process memory to steal credentials from CI runners.

• Issue: aquasecurity/trivy-action is compromised aquasecurity/trivy-action#541
• Exposure window (UTC): 2026-03-19 ~17:43 – 2026-03-20 ~05:40
• Malicious commit: aquasecurity/setup-trivy@8afa9b9
• Details: https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release

As recommended by the maintainers:

"As hard as it may be: do not use Trivy anymore for now."

Any repository that ran a workflow using this action during the exposure window may have had secrets exfiltrated. Rotate any secrets that were available to workflows using this action.

What this PR does

Removes the aquasecurity/trivy-action step(s) from this workflow. The uses: directive and its with: block have been replaced with a run: step that creates an empty but valid SARIF file (where applicable), so downstream steps (e.g. upload-sarif) continue to pass.

Note: Repo owners should review whether the entire workflow/job can now be removed, or whether an alternative scanning solution should be adopted.

Raised automatically for review.