[CI] Add Docker image hardening and vulnerability scan workflow

[utksh1]

Problem

SecuScan needs a production-grade improvement in this area: Container release safety..

Scope

Scan backend/frontend images, fail on critical vulnerabilities, check non-root user, and document base-image update policy.

Acceptance Criteria

• The implementation is focused and does not introduce unrelated UI, docs, lockfile, or formatting churn.
• Security-sensitive behavior has explicit negative tests where applicable.
• Existing tests continue to pass, and new tests cover the main success and failure paths.
• Documentation or configuration examples are updated when operator behavior changes.

Verification

CI should publish vulnerability reports and fail on a synthetic or known critical baseline only when policy requires.

Difficulty

Hard, useful issue intended for experienced contributors.

[Aditi-24-05]

Hi, I am a GSSoC 2026 contributor and would like to work on this issue and wanted to get assigned!

My approach:

• Fix backend/Dockerfile: add a non-root system user (appuser) so the container doesn't run as root

• Fix frontend/Dockerfile: set correct nginx permissions and switch to USER nginx

• Create .github/workflows/docker-scan.yml: builds both images, runs Trivy to scan for CVEs, fails CI on Critical severity, and uploads vulnerability reports as artifacts

• Add docs/BASE_IMAGE_POLICY.md: documents base images used (python:3.11-slim, nginx:alpine) and the update cadence policy

Happy to discuss any part of the approach before starting

[aaniya22]

Please assign this issue to me under Gssoc'26