Add container vulnerability scanning

[VirtuArchitect]

Summary

• add Trivy container image scans to the Docker CI job
• upload table and SARIF scan artifacts before enforcing the vulnerability gate
• fail CI on fixable high/critical OS or library vulnerabilities
• refresh Debian packages during image builds so fixed base-image CVEs are not shipped
• document the new container supply-chain control

Verification

• python -m pytest -q
• python -m pip_audit --skip-editable
• python -m bandit -r src --severity-level medium
• docker build --pull -t strataone-api:ci .
• docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.74.0 image --scanners vuln --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1 strataone-api:ci
• docker compose config --quiet
• git diff --check

Security Notes

• Adds a CI supply-chain gate and report artifacts; no application runtime API, auth, or data-path behavior changed.
• Local Trivy smoke scan reported 0 high/critical vulnerabilities after rebuilding the image.