Upload bakery trivy scan SARIF results to GitHub code scanning

bakery trivy scan (#218, #722) now writes SARIF per target to results/trivy/, but doesn't upload it to GitHub code scanning. Adding security-events: write to bakery-build-native.yml's build-test job during #722's review would have hard-failed every existing caller (this repo's own ci.yml, plus images-connect/images-workbench/images-package-manager, all pinned to @main) on their next run — GitHub validates a reusable workflow's requested job permissions against the caller's grant before the job runs, independent of any step-level if: gate.

The images-shared side is now implemented and waiting in #734, which is stacked on #722. It must not merge until the product-repo grants land.

• Add security-events: write to images-shared's own ci.yml caller job (the bakery-native job) — done in #722
• Add security-events: write to each of images-connect/images-workbench/images-package-manager's calling jobs
• Re-add security-events: write and the github/codeql-action/upload-sarif step to bakery-build-native.yml's build-test job — done in #734
• Sequence: merge the three product-repo permission grants before merging #734, so no caller is ever left mid-transition without a permission its currently-running workflow file expects

Notes from implementing #734

• Filenames and categories are now separate. results/trivy/<image>/<uid>.sarif is unique per target; the version-stable category rides in each run's automationDetails.id. upload-sarif only fills automationDetails in when it is absent, so a single directory upload carries a distinct category per file. Deriving the filename from the category (as #722 originally did) collapsed 50 images-connect targets onto 6 files, silently overwriting 44 versions' results.
• Scope is native builds only. #722 now gates scanning on push && latest, so code scanning only ever sees published, latest-version images. PR-build scanning moved to #741 as an opt-in input and is deliberately not wired to code scanning: fork PRs get a read-only token and cannot be granted security-events: write, and PR-time uploads of non-latest versions would have no baseline on main to diff against.

Related

• https://github.com/posit-dev/images-shared/issues/218
• https://github.com/posit-dev/images-shared/pull/722
• https://github.com/posit-dev/images-shared/pull/734
• https://github.com/posit-dev/images-shared/pull/741
• https://github.com/posit-dev/platform-team/issues/440

Start by reviewing bakery-build-native.yml and the bakery-native caller job in ci.yml, then inspect the calling jobs in images-connect, images-workbench, and images-package-manager. Compare the permission changes with #722 and #734; done means all three product-repo callers grant security-events: write before the reusable workflow changes merge.