Revert "experiment: don't checkout the repo unless we have to build the docker image"

technically, it is an option to delay checking out the repo, however we'd need to duplicate the logic from the Makefile around the expected image name.
i think not worth it.

This reverts commit 95a8a18.

Author: lisac

.github/workflows/vulnerability-scans.yml

@@ -48,10 +48,14 @@ jobs:
       image: ${{ steps.create-image-identifier.outputs.image }}
 
     steps:
+      - uses: actions/checkout@v4
+
       - name: Create image identifier
         id: create-image-identifier
         run: |
-          echo "image=${{ inputs.app_name }}-docker-image-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          IMAGE_NAME=$(make APP_NAME=${{ inputs.app_name }} release-image-name)
+          IMAGE_TAG=$(make release-image-tag)
+          echo "image=$IMAGE_NAME:$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Check whether the image has already been built
         id: check-image-already-exists
@@ -61,8 +65,6 @@ jobs:
           key: ${{ steps.create-image-identifier.outputs.image }}
           lookup-only: true
 
-      - uses: actions/checkout@v4
-
       - name: Build and tag Docker image for scanning
         if: steps.check-image-already-exists.outputs.cache-hit != 'true'
         run: |