Fix build-scan-sign false failures by scoping Trivy gate to vulnerability scanning

[Copilot]

The build-scan-sign GitHub Actions job was failing in the Trivy step despite the intended policy being a CRITICAL/HIGH vulnerability gate. This updates the workflow to enforce that gate only on vulnerability results.

• CI scan gate alignment

  • Updated .github/workflows/docker-build-scan-sign.yml in build-scan-sign:
    • Added scanners: vuln to the Trivy action input.
  • Kept existing policy controls unchanged (exit-code: 1, severity: CRITICAL,HIGH, ignore-unfixed: true).

• Operational impact

  • The scan step now evaluates only vulnerability findings for pass/fail.
  • Non-vulnerability scanners no longer influence this release gate.

- name: Scan built image with Trivy (fail on CRITICAL/HIGH)
  uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
  with:
    image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-scan
    scanners: vuln
    format: sarif
    output: trivy-results.sarif
    exit-code: 1
    severity: CRITICAL,HIGH
    ignore-unfixed: true