Add .trivyignore to reduce duplicate container scan alerts

[pavelzbornik]

Problem

Trivy container scanning produces ~14 alerts in the GitHub Security tab, with significant noise:

• 4 duplicate alerts for CVE-2024-10963 (pam) — same CVE across image layers
• 2 duplicate alerts for GHSA-pwjx-qhcg-rvj4 (webpki) — duplicate detection
• Multiple unfixable OS-level vulnerabilities from nvidia/cuda:13.0.1-base-ubuntu24.04 base image (glibc, gnutls)

Currently no .trivyignore file exists — Trivy runs with all defaults.

Trivy vs Dependabot Scope

These tools are complementary, not overlapping:

• Trivy: Container OS layer (glibc, gnutls, pam, SQLite, webpki)
• Dependabot: Python packages (requests, pillow, protobuf, etc.)

The noise comes from Trivy's duplicate detection and unfixable base image vulnerabilities.

Tasks

• Create .trivyignore file with documented suppressions for:
  • Duplicate pam CVEs (explain: same CVE, multiple layers)
  • Duplicate webpki alerts (explain: duplicate detection)
  • Unfixable base image vulns with no available patch (glibc, gnutls) — with review date
• Check if a newer nvidia/cuda base image patches any OS-level vulnerabilities
• Verify Trivy scan runs cleanly with reduced alert count
• Dismiss corresponding stale alerts in GitHub Security tab

Acceptance Criteria

• .trivyignore file with documented suppressions
• GitHub Security tab reduced from ~14 to ~5 actionable alerts
• No legitimate vulnerabilities suppressed