CVE scan job fails in release branches

CSE Scan job tries to download module from PROD_REGISTRY instead of DEV_REGISTRY if branch has dots in the name (release-1.4, for example)

++ echo
++ echo =======================================================
++ echo
++ echo '$ echo "Setting up registry path for module" # collapsed multi-line command'
++ echo 'Setting up registry path for module'
++ PROD_REGISTRY_MODULE_BASEDIR=registry.deckhouse.io/deckhouse/fe/modules
++ DEV_REGISTRY_MODULE_BASEDIR=dev-registry.deckhouse.io/sys/deckhouse-oss/modules
++ severity=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
++ latest_releases_amount=3
++ '[' -z release-1.4 ']'
++ '[' -n '' ']'
++ module_tags=("${TAG}")
++ '[' push == schedule ']'
++ echo 'Getting tags to scan'
++ echo release-1.4
++ grep -q '[0-9]*\.[0-9]*'
++ module_tags=($(crane ls "${PROD_REGISTRY_MODULE_BASEDIR}/${MODULE_NAME}" | grep "^v${TAG}\.[0-9]*" | sort -V -r | head -n 1))
+++ grep '^vrelease-1.4\.[0-9]*'
+++ crane ls registry.deckhouse.io/deckhouse/fe/modules/commander-agent
+++ sort -V -r
+++ head -n 1

Start at the CSE Scan job's registry setup, where PROD_REGISTRY_MODULE_BASEDIR and DEV_REGISTRY_MODULE_BASEDIR are selected, and inspect the branch-name and tag-selection logic using crane. Reproduce the scan for a dotted release branch such as release-1.4; done means it selects the development registry rather than the production registry for that branch.