Trivy code-scanning check reports pre-existing alerts as new on large-diff PRs

## Description

The `Trivy` code-scanning check fails on any PR with a large diff in `reserve-rec-admin`, reporting pre-existing vulnerabilities as though the PR introduced them. Most recently on #333 (Angular 19 → 21), where it reported *"52 new alerts including 1 critical severity security vulnerability"*.

**None of those alerts were new.** Comparing all 70 alerts attributed to the PR against the 119 open Trivy alerts on `main`, every one already existed on `main`. GitHub says so itself in the check output:

> Alerts not introduced by this pull request might have been detected because the code changes were too large.

PR #333 rewrote 6,715 lines of `yarn.lock`, so diff attribution swallowed the entire pre-existing backlog.

## Evidence

What the check blamed on #333:

| Location | Count | Notes |
|---|---|---|
| `yarn.lock` | 52 | Transitive dev/build CVEs — `minimatch` ×15, `moment` 2.18.1, `immutable` 3.7.6 (the "critical"), `tinymce`, `uuid`, `ws`, `lodash`, `aws-cdk-lib` |
| `template.yaml` | 18 | AWS config findings — CloudFront WAF/TLS, S3 public-access-block, CMK encryption |

`template.yaml` **is not in that PR's diff at all** (the PR touches only `angular.json`, `package.json`, one spec file, `tsconfig.json`, `yarn.lock`). This matters: no amount of dependency bumping can turn the check green, because the 18 infra findings would survive — and hardening a SAM template inside an Angular upgrade PR is the wrong place to do it.

Two further notes:
- The `Trivy Security Scan` **job** passes. It only uploads SARIF (`exit-code` is unset, so the scan never fails the job). The red X is the separate GitHub Advanced Security code-scanning check run.
- `Trivy` is **not** a required status check — the `main` ruleset requires only 1 approving review, signatures, and linear history. So today this is misleading noise rather than a hard block, but it costs reviewer attention and trains people to ignore a security signal.
- `reserve-rec-public` has no `analysis.yaml` at all, which is why the equivalent Angular PR there (reserve-rec-public#635) merged clean.

## Options to discuss

1. **Gate the SARIF upload to non-PR events** — add `if: github.event_name != 'pull_request'` to the `upload-sarif` step in `.github/workflows/analysis.yaml`. Scan still runs on PRs; the Security tab keeps tracking `main`. Removes the false positive permanently.
2. **Lower the code-scanning check-failure severity** (Settings → Code security → Code scanning). Repo-wide, and would also suppress genuinely-new findings.
3. **Burn down the real backlog** — `resolutions` entries for the fixable transitive CVEs (the repo already uses this pattern) plus a separate ticket to harden `template.yaml`. Addresses the underlying debt but does not fix the false-positive behaviour.

These aren't mutually exclusive — 1 or 2 stops the noise, 3 addresses the actual 119 open alerts on `main`.

## Notes

- Raised off the back of #333. That PR was left as-is by decision; no CI changes were made.
- Worth deciding whether `analysis.yaml` should exist in only this repo or across all Osprey repos consistently.

Start by reading .github/workflows/analysis.yaml, especially the Trivy scan and upload-sarif steps, and inspect how the workflow behaves for pull_request and non-PR events. Confirm the chosen scope for this repository or the Osprey repos, then verify that PR scans no longer create misleading code-scanning results while main-branch scanning remains available.

Written by the indexing model from the issue text.