Port Trivy image scanning from rstudio-docker-products

Trivy is a widely-used open-source security scanner. We would like to implement scanning with Trivy so that we can preview what customers using it will see when they scan our images. Trivy is also the scanner customers can run themselves — bakery wizcli scan covers internal scanning, but Wiz is not available to customers.

Port from rstudio-docker-products

Trivy scanning is already implemented in rstudio-docker-products, where it replaced Snyk:

• https://github.com/rstudio/rstudio-docker-products/pull/1039

Implementation to port:

• tools/trivy_bake_artifacts.py — expands a docker buildx bake --print group into child image targets, runs trivy image on each (HIGH/CRITICAL severity), and merges per-target SARIF into one container.sarif; always exits 0 so findings never fail the build
• Per-image trivy.yaml configs for image-specific settings (e.g. workbench/trivy.yaml); present for all products and init images
• Justfile trivy-test / preview-trivy-test recipes as the local entry points
• .github/actions/bake-test-push/action.yml — installs Trivy via aquasecurity/setup-trivy, runs the scan behind a scan-image flag, and uploads SARIF to GitHub code scanning with a per-target category

Desired behavior

• bakery trivy scan subcommand alongside bakery wizcli scan
• Per-image Trivy config support (equivalent of the per-image trivy.yaml)
• SARIF output suitable for github/codeql-action/upload-sarif
• Wired into the shared CI workflows
• https://github.com/posit-dev/images-shared/pull/722

Related

• https://github.com/posit-dev/images-shared/issues/482
• https://github.com/posit-dev/images-shared/issues/217