Add dependency security check using trivy

[lafriks]

Fixes #899

This could be also done for docker image security check but that would probably require building docker image to tar file so I did not add that in this PR.

I usually do this with such steps:

  docker-dryrun:
    image: thegeeklab/drone-docker-buildx:20
    settings:
      registry: xxx
      username:
        from_secret: docker_username
      password:
        from_secret: docker_password
      repo: xxx/${CI_REPO_OWNER}/${CI_REPO_NAME}
      tags: test
      dry_run: true
      output: type=oci,dest=${CI_REPO_OWNER}-${CI_REPO_NAME}.tar
    when:
      event:
      - pull_request

  docker-image-security-check:
    image: aquasec/trivy:latest
    commands:
      - trivy image --exit-code 0 --severity UNKNOWN,LOW --input ${CI_REPO_OWNER}-${CI_REPO_NAME}.tar
      - trivy image --exit-code 1 --severity MEDIUM,HIGH,CRITICAL --input ${CI_REPO_OWNER}-${CI_REPO_NAME}.tar
    when:
      event:
        - pull_request

[6543]

well before we can merge it, I guess we have to bump frontend deps ...

... witch we also should do for release branch as long as possible ...

[lafriks]

should I fix security issues here or on other PR?

[6543]

I dont mind ...

... a seperate pull might be better in terms of backporting

[lafriks]

I changed not to fail security check step for docs as it does not seems to be fixable at the moment 😕

[woodpecker-bot]

Deployment of preview was successful: https://woodpecker-ci-woodpecker-pr-1163.surge.sh

[6543]

-> https://github.com/aquasecurity/trivy/pull/2823