CVE_Scan: clone the scan scripts into a unique directory, not /tmp/cve-scripts

The before_script of the CVE scan template clones its helper scripts into a fixed path:

echo "Cloning cve-scripts repository"
rm -rf /tmp/cve-scripts
git clone --depth 1 --branch v2.0 "$CVE_TEST_REPO_GIT" /tmp/cve-scripts
cp /tmp/cve-scripts/*.sh /tmp/cve-scripts/*.py .

The deckhouse-gitlab-runner-* runners are shared across the group, so two scan jobs from different projects can land on the same runner at the same time. When they do, one job's rm -rf and git clone race against the other's, and the loser dies before running a single line of the scan:

fatal: Untracked working tree file '.gitignore' would be overwritten by merge.

We hit this on the default branch of deckhouse/virtualization/ansible-module (the scan job of pipeline 731119); a retry landed on another runner and passed.

A consumer of the template cannot work around it:

• overriding before_script in the job replaces the template's own, which is where the Vault token is obtained and the vault: values are resolved;
• retry: when: script_failure does not help either, because "vulnerabilities found" exits with the same status — every scan with findings would burn Trivy three times.

Suggested fix — a unique directory per job, removed on the way out:

cve_scripts_dir="$(mktemp -d)"
trap 'rm -rf "${cve_scripts_dir}"' EXIT
git clone --depth 1 --branch v2.0 "$CVE_TEST_REPO_GIT" "${cve_scripts_dir}"
cp "${cve_scripts_dir}"/*.sh "${cve_scripts_dir}"/*.py .

Happy to send this as a pull request if that is easier.

Locate the CVE scan template and its before_script, starting from the fixed /tmp/cve-scripts clone shown in the issue. Check the template's Vault setup and run concurrent scan jobs to reproduce the shared-directory race. Done means each job uses an isolated temporary directory, cleans it up on exit, and no longer fails due to another scan.