The action aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 is not allowed in microsoft/aspire.dev because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1, pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320. All actions must also be pinned to a full-length commit SHA.