infra: Docker images not scanned for vulnerabilities in CI

[Xhristin3]

Problem Statement
The CI pipeline builds and tests code but does not scan Docker images for OS-level or dependency vulnerabilities. A base image could contain known CVEs only discovered after deployment.

Why It Matters
Image scanning is a standard supply-chain security control. Catching CVEs before push prevents deploying known-vulnerable images.

Acceptance Criteria

• Add Trivy (or Grype) image scanning step to CI after each docker build
• Workflow fails if CRITICAL severity vulnerabilities are found
• Scan results uploaded as GitHub Security Code Scanning alerts
• Weekly scheduled scan of already-published images
• .trivyignore file for accepted false-positives with documented justification

Files Affected: .github/workflows/ci.yml, .github/workflows/release.yml

Difficulty: Easy | Effort: 2–4 hours

[Eleora57]

Hello. can i work on this please

[grantfox-oss]

🦊 GrantFox — @Eleora57 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #372)
2. Your PR will be reviewed by the XStreamRollz maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@Eleora57's PR #468 was approved and merged by @Xhristin3.

🏆 @Eleora57: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (51 total points). Track your full progress on GrantFox.

👏 Great work, @Eleora57! Keep contributing to XStreamRollz.