feat(ci-cd): add trivy scan

[vaibhavbhalla2505]

Description

add trivy scan

Fixes #101

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Intermediate change (work in progress)

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Any dependent changes have been merged and published in downstream modules

[sonarqubecloud]

SonarQube reviewer guide

Summary: Add Trivy security scanning workflow and dependency updates including validator, node-forge, jws, and glob packages.

Review Focus:

• The Trivy configuration in trivy.yml which scans for HIGH/CRITICAL vulnerabilities and secrets
• Dependency version updates throughout package-lock.json, particularly security-related packages
• Workflow trigger configuration to run on PRs to master branch

Start review at: .github/workflows/trivy.yaml. This is the core addition that introduces automated security scanning to the CI/CD pipeline and should be validated first to ensure proper configuration for vulnerability detection.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[yeshamavani]

🎉 This PR is included in version 5.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀