fix: Update Trivy setup action version to v0.2.6

[meher-liatrio]

The third party action was pinned to a compromised version, the release of which has been removed and is causing the audit pipeline to fail: https://github.com/pact-foundation/pact-broker-docker/actions/runs/24487795586

This pr pins the action to the commit sha of the only currently valid release per the docs: https://github.com/aquasecurity/setup-trivy

Further rumination steps may be required by maintainers: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/

[mefellows]

Thank you, much appreciated.

[YOU54F]

Thanks @meher-liatrio,

I don't believe we were impacted, there was a single audit run on March 19

https://github.com/pact-foundation/pact-broker-docker/actions/runs/23275257708/job/67676800999

which checked out this ref of trivy

Checking out the ref
/usr/bin/git log -1 --format=%H
20458b836b71b2bed72d31ebba1ba9572333dcfd

aquasecurity/trivy@20458b8

and installed

installing Trivy binary
aquasecurity/trivy info checking GitHub for tag 'latest'
aquasecurity/trivy info found version: 0.69.3 for v0.69.3/Linux/64bit
aquasecurity/trivy info installed /home/runner/.local/bin/trivy-bin/trivy

The job ran at Mar 19, 1:23 AM GMT, with the attack taking place on March 19, 2026 (~17:43 UTC)

The subsequent job ran a week later, which correctly failed as the tag was removed as you identified.

Thanks for the remediation follow up links