investigate(security): evaluate safe container image scanning in public pipelines

We need to evaluate the security and operational impact of running container image scanning (e.g., Trivy in image mode) within our public GitHub Actions workflows.

### Concerns:
1. **Information Disclosure / Reconnaissance**: Dumping raw CVE vulnerability reports (containing library versions and specific CVE IDs) to public job logs creates an easy reconnaissance vector for attackers targeting public preview deployments.
2. **Build Blockages vs. Upstream Fixes**: Standard image scans block builds on unpatched base image packages (e.g. Alpine/Debian system libraries). This can bottleneck developer workflows when no upstream patch is available unless scanning is non-blocking.
3. **Build Performance**: Image scanning adds build-time overhead to PR pipelines.

### Proposed Solutions to Investigate:
- **Private SARIF uploads**: Configure Trivy to generate SARIF output and use `github/codeql-action/upload-sarif` to upload results privately to the GitHub Security tab (restricting view to repository maintainers).
- **Cluster-side scanning**: Offload container scanning entirely to Red Hat Advanced Cluster Security (RHACS) inside the OpenShift namespace rather than scanning in the public CI runner.

```yaml
scan-images:
name: Scan Images
needs: [builds]
runs-on: ubuntu-24.04
strategy:
matrix:
package: [backend, frontend, migrations]
permissions:
contents: read
packages: read
steps:
- name: Run Trivy in image mode
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: 'ghcr.io/${{ github.repository }}/${{ matrix.package }}:${{ github.event.number }}'
format: 'table'
exit-code: '0'
ignore-unfixed: true
severity: 'CRITICAL,HIGH'
```