Better support for automated security scans

We're using [distroless](https://github.com/GoogleContainerTools/distroless) base images to build the project. This is good for optimization of the container images but won't work for security scans such as the ones run by Quay Security Scanner (based on [Clair](https://coreos.com/clair/)).

`docker scan`, which relies on [Snyk](https://snyk.io/), is a good alternative for local environment and CI. Nevertheless, we likely want something that is supported by Quay.io as well.

No files, tests, or entry points are named. Start by locating the project’s container build definitions and reviewing how distroless images are produced; compare Quay Security Scanner/Clair support with docker scan and Snyk, and define the supported scanning approach and its validation before implementation.

Written by the indexing model from the issue text.