Compromised aquasecurity/trivy-action detected in GitHub Actions workflows

### Compromised `aquasecurity/trivy-action` detected in workflow run(s)

Our automated platform at [StepSecurity](https://www.stepsecurity.io) has detected that this repository used a **compromised version of `aquasecurity/trivy-action`** in its GitHub Actions workflows during the recent Trivy incident. I have also manually confirmed that the affected workflow run(s) indeed used the compromised action.

#### What happened?

The `aquasecurity/trivy-action` GitHub Action was compromised, and a malicious version (`v0.69.4`) was published. Workflow runs in this repository executed a compromised SHA of this action, which may have exposed sensitive information such as secrets, environment variables, or build artifacts.

For more details on the incident, see [StepSecurity Blog: Trivy Compromised a Second Time](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release).

#### Compromised SHAs detected

- `aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1` (e6c2c5e321ed9123bda567646e2f96565e34abe1)
- `aquasecurity/trivy-action@ab6606b76e5a054be08cab3d07da323e90e751e8` (0.34.0)

#### Affected workflow runs

| # | Workflow Run | Build Log (compromised step) |
|---|-------------|------------------------------|
| 1 | [23323788737](https://github.com/appleboy/ssh-action/actions/runs/23323788737) | [View compromised action step](https://github.com/appleboy/ssh-action/actions/runs/23323788737/job/67840565389#step:1:46) |

#### Current workflow status

The workflow in this repository is still referencing the action using a **mutable tag** rather than a pinned SHA: [View current workflow](https://github.com/appleboy/ssh-action/blob/master/.github/workflows/trivy-scan.yml#L28).

#### Recommended actions

1. Review the compromised workflow job run(s) and identify if the job had access to any secrets. If yes, consider them exfiltrated and rotate them immediately
2. [Pin GitHub Actions to full-length commit SHAs](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions) to prevent future tag-based supply chain attacks. You can use [StepSecurity Secure Repo](https://app.stepsecurity.io/securerepo) to automatically pin GitHub Actions

#### References

- [StepSecurity Blog: Trivy Compromised a Second Time](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release)