Chore: [AEA-0000] - move to new quality checks

[anthony-nhs]

Summary

• Routine Change

Details

• move to new quality checks

[Copilot]

Pull request overview

This PR updates the repository’s security/quality tooling configuration to align with the newer “quality checks” approach (moving away from Trivy ignores and introducing Grype/Zizmor configuration), and tightens GitHub Actions permissions.

Changes:

• Add Zizmor and Grype configuration, remove legacy Trivy ignore configuration.
• Add a local pre-commit hook to run a Grype scan on local changes and ignore generated SBOM output.
• Update GitHub Actions workflows to use permissions: {} by default and bump referenced shared workflow revisions / devcontainer image version.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
zizmor.yml	Adds an ignore entry for Zizmor’s unpinned-images rule.
trivy.yaml	Removes Trivy ignorefile configuration.
.trivyignore.yaml	Removes legacy Trivy vulnerability ignore list.
.pre-commit-config.yaml	Adds a local Grype scan hook.
.grype.yaml	Adds Grype vulnerability ignore configuration.
.gitignore	Ignores generated .sbom/ directory.
.github/workflows/sync_copilot.yml	Sets default workflow token permissions to none ({}) and specifies minimal job permissions.
.github/workflows/release.yaml	Updates shared workflow refs, pins checkout action, disables persisted credentials, and applies permission hardening.
.github/workflows/pull_request.yaml	Updates shared workflow refs, disables persisted credentials, and applies permission hardening.
.github/workflows/ci.yaml	Updates shared workflow refs and applies permission hardening.
.github/CODEOWNERS	Adds CODEOWNERS rule for workflow changes.
.devcontainer/devcontainer.json	Bumps devcontainer image version.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud