Github workflow for scanning CVEs

[kevinjqliu]

I saw mentions of the lack of CVE scan for Spark. We added this github workflow to the Iceberg project to scan artifacts the project produces: https://github.com/apache/iceberg/blob/main/.github/workflows/cve-scan.yml

Free feel to adjust for this repo.

It uses a sandboxed version of trivy: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 that is already blessed by ASF Infra

[h3pdesign]

Great exactly what we need