DEVOPS-825 - Add Trivy container security scanning

[jsfillman]

Summary

This PR adds vulnerability scanning to our base pull request workflows by:

1. Creating a new reusable_trivy-scans.yml workflow.
2. Adding a call to the above workflow in pr_build.yaml.

Overview

• The step reusable_trivy-scans.yml first uses an older version of Trivy to check for the following CVEs, which are automatically rejected by NERSC:
  • CVE-2021-4104
  • CVE-2021-44228
  • CVE-2021-45046
  • CVE-2022-22965
• If any of these errors are found, the entire workflow will fail.
• If none of these CVEs are found, the latest version of Trivy is run to check for any additional errors.
  • Any responses that are found will show as a failure and be listed in the PR's Checks tab, but the workflow itself will pass.

Testing

1. Created a repo that builds Zookeeper docker images.
2. Created a PR that tries to build a version known to have the above log4j errors.

• This PR fails, and gives useful errors.

3. Created a second PR that builds a known-good version of Zookeeper.

• This PR shows a passing workflow, but fails on the latest Trivy check, providing a convenient list of vulnerabilities.

[kkellerlbl]

looks good to me