STAC-25076: make Grype scans use VEXHub

[LouisLotter]

Summary

• download configured VEX repositories before vulnerability scans
• collect valid OpenVEX documents from the Trivy VEX cache and fail clearly when none are available
• skip malformed/non-OpenVEX lookalike files before passing documents to Grype
• pass the collected OpenVEX documents to Grype via --vex so VEXHub applies consistently across Trivy and Grype
• update the scan-image README to describe the shared VEX path

Root cause

The reusable scan-image action configured VEXHub only for Trivy. Grype still ran without VEX documents, so VEXed CVEs could remain unmanaged in downstream gates such as docker-images PR #121.

Review feedback addressed

• Avoid copying VEX repository contents into parent directories, because the current VEXHub manifests already download into the expected Trivy cache layout and copying duplicated the Grype --vex document list.

Validation

• ruby YAML parse for .github/actions/scan-image/action.yml
• go test ./... in evaluator with tmp Go caches
• uvx zizmor --collect=workflows,actions,dependabot .
• local temp-HOME VEX repo download/document collection smoke with Trivy 0.70.0, finding 861 valid OpenVEX documents and skipping 3 malformed/non-OpenVEX lookalikes
• git diff --check
• GitHub Actions: Workflow Security Audit passed
• GitHub Actions: Action unit tests passed across local-clean/known-vuln and amd64/arm64

Jira: https://stackstate.atlassian.net/browse/STAC-25076