feat: migrate Trivy workflow to reusable SHA-pinned action (TRG 8.04)

## Context

The current `.github/workflows/trivy.yml` in this repository uses a **mutable tag** to reference `aquasecurity/trivy-action` (e.g. `@v0.x.y` or `@master`). Mutable tags can be silently redirected by a compromised upstream release, making the workflow a potential supply chain attack vector.

As part of the Tractus-X security hardening initiative, the Trivy workflow is being migrated to:

1. A **centralized reusable workflow** hosted in [eclipse-tractusx/sig-infra](https://github.com/eclipse-tractusx/sig-infra/blob/main/.github/workflows/reusable-trivy.yaml)
2. All action references inside it are **pinned to immutable commit SHAs**

This approach ensures the SHA is maintained in a single place and all consuming repositories automatically benefit from updates without individual patches.

## What needs to be done

Replace the content of `.github/workflows/trivy.yml` with a lightweight caller that delegates to the reusable workflow:

```yaml
name: "Trivy"

on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:

permissions:
contents: read

jobs:
trivy:
uses: eclipse-tractusx/sig-infra/.github/workflows/reusable-trivy.yaml@main
permissions:
actions: read
contents: read
security-events: write
```

> **Note:** If this repository also runs a **docker image scan** with Trivy (build + scan matrix), that job is repo-specific and should remain local. Only the config/IaC scan is covered by the reusable workflow.

## Acceptance Criteria

- [ ] `.github/workflows/trivy.yml` calls the reusable workflow from `sig-infra` instead of invoking `aquasecurity/trivy-action` directly
- [ ] No mutable action tag references remain in any Trivy-related workflow file
- [ ] Trivy scan results are still uploaded to the GitHub Security tab (handled by the reusable workflow)
- [ ] Workflow runs successfully on `main` branch after the change

## Related

- TRG 8.04: Mitigate high and above findings in Trivy
- Reusable workflow: [eclipse-tractusx/sig-infra - reusable-trivy.yaml](https://github.com/eclipse-tractusx/sig-infra/blob/main/.github/workflows/reusable-trivy.yaml)
- Tracking: eclipse-tractusx/sig-infra#567

Start by reading .github/workflows/trivy.yml and checking whether any separate Trivy image-scan job must remain local. Replace the config/IaC workflow content with the caller shown in the issue, then inspect related Trivy workflow files for mutable action tags. Done means the reusable workflow is called, required permissions remain, and the workflow succeeds on main with results uploaded to the Security tab.

Written by the indexing model from the issue text.