feat: migrate Trivy workflow to reusable SHA-pinned action (TRG 8.04)

## Context

The current Trivy workflow(s) in this repository use **mutable tags** to reference `aquasecurity/trivy-action` (e.g. `@0.34.1`). Mutable tags can be silently redirected by a compromised upstream release, making the workflow a potential supply chain attack vector.

As part of the Tractus-X security hardening initiative, the Trivy workflow is being migrated to:

1. A **centralized reusable workflow** hosted in [eclipse-tractusx/sig-infra](https://github.com/eclipse-tractusx/sig-infra/blob/main/.github/workflows/reusable-trivy.yaml)
2. All action references inside it are **pinned to immutable commit SHAs**

This approach ensures the SHA is maintained in a single place and all consuming repositories automatically benefit from updates without individual patches.

## What needs to be done

Replace or extend the Trivy config/IaC scan with a lightweight caller that delegates to the reusable workflow:

```yaml
name: "Trivy"

on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:

permissions:
contents: read

jobs:
trivy:
uses: eclipse-tractusx/sig-infra/.github/workflows/reusable-trivy.yaml@main
permissions:
actions: read
contents: read
security-events: write
```

> **Note:** This repository runs a **docker image scan** with Trivy via a build matrix (`app-test-trivy.yaml`). That job is repo-specific and should remain local - ensure all `aquasecurity/trivy-action` references there are also **SHA-pinned**. The reusable workflow covers the config/IaC scan only.

## Acceptance Criteria

- [ ] Config/IaC Trivy scan calls the reusable workflow from `sig-infra`
- [ ] No mutable action tag references remain in any Trivy-related workflow file (including image scan workflows)
- [ ] Trivy scan results are still uploaded to the GitHub Security tab
- [ ] Workflow runs successfully on `main` branch after the change

## Related

- TRG 8.04: Mitigate high and above findings in Trivy
- Reusable workflow: [eclipse-tractusx/sig-infra - reusable-trivy.yaml](https://github.com/eclipse-tractusx/sig-infra/blob/main/.github/workflows/reusable-trivy.yaml)
- Tracking: eclipse-tractusx/sig-infra#567

Start by locating the current Trivy config/IaC workflow and reviewing app-test-trivy.yaml, including every aquasecurity/trivy-action reference. Compare the caller with sig-infra/.github/workflows/reusable-trivy.yaml, then verify that the config scan uses the reusable workflow, image scans use SHA-pinned actions, results reach the Security tab, and the workflow succeeds on main.

Written by the indexing model from the issue text.