Re-introduce container vulnerability scanning

[jayaddison]

...but during GitHub Actions workflows instead of the previous approach that relied upon local running of the script by users/developers.

The tradeoffs:

• ➕ Results will be more visible to the wide audience of of grocy-docker users
• ➖ It'll be more difficult for users who self-build to run vulnerability scans
• ❔ We move the trust surface from local users to "the cloud"

References: #109 (comment), #170

[jayaddison]

Note: let's run this after merges to the main branch, and make it a dependency for the publication step. It'll add a small amount of delay to that process, but with a counterbalancing large benefit when it does catch any potential issues.

[jayaddison]

This was attempted in #172, but the resulting GitHub Actions jobs are failing, including after some fixup attempts. Reverting for now.

[jayaddison]

After attempting all that and reviewing some of the build log failure messages: I'm not sure that Snyk's container scanning action supports OCI images - I think it assumes that a local Docker daemon will be available as a registry.

That's fine; theoretically it'd be possible to run a registry service, push the buildah-constructed images to the registry during the build, then scan them, and finally publish them to Docker Hub.

However I think it's worth pausing to do a bit of research to see whether there's a more streamlined approach that does support OCI containers, Snyk or otherwise.

[jayaddison]

Anchore's scan action looks like an alternative that is worth considering; it supports OCI image scanning and is open source. I'm going to experiment with introducing it into the container publication workflow.

[jayaddison]

The scanning rules used by the scan action come from a tool called Grype (also developed by Anchore), and their rule database is compiled from a list of publicly available sources: https://github.com/anchore/grype#grypes-database

[jayaddison]

Container scanning is now enabled at release-time using the anchore/scan-action GitHub Actions plugin.

With reference to one of the tradeoffs from earlier in this thread:

• ➕ Results will be more visible to the wide audience of of grocy-docker users

Some visibility is currently configured; job logs include output to indicate whether the scan found medium-or-higher vulnerabilities, but details are not provided, by default (maintainers are able to see more). That seems reasonable currently.

Thank you to @some-natalie for discussing a bunch of the practicalities of getting this working - I was going around in circles.