Add vulnerability scanning in CI

[pnoltes]

Add vulnerability scanning to the CI pipeline based on the generated SBOM.

Scope

• Scan SBOM build artefact for known vulnerabilities (CVE / CVSS)
• Use OSS tooling (e.g. grype, trivy, osv-scanner)
• Initial setup is report-only (no CI gating)
  • Bonus: add CI gating for issues with a CVSS of 9 or higher.

tool recommendations are welcome.

Expected outcome

• CI job that performs vulnerability scanning
• Machine-readable scan output published as a CI artifact
• Short documentation describing:
  • which tool is used
  • what is (and is not) covered