Run the image vulnerability scan on a weekly schedule (#30)

* Run the image vulnerability scan on a weekly schedule

The Trivy scan added in #29 only ran against changed code (PRs and
pushes), so a CVE disclosed against an otherwise unchanged base image
would go unnoticed until the next actual change. Add a weekly cron
trigger, matching Dependabot's cadence in .github/dependabot.yml.

The push job's existing `if: github.event_name == 'push'` guard means
a schedule-triggered run builds and scans but never publishes.

* Add workflow_dispatch so the scan can be run on demand

Copilot review on PR #30 suggested this: waiting for the Monday cron
to validate a fix is unnecessary friction. workflow_dispatch has no
inputs, so it just re-runs the same build/test/scan on demand; the
push job's event_name guard still keeps it from publishing.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

.github/workflows/docker-publish.yml

@@ -9,6 +9,14 @@ on:
 
   pull_request:
 
+  # Catch newly disclosed CVEs against unchanged code; matches Dependabot's
+  # weekly cadence in .github/dependabot.yml.
+  schedule:
+    - cron: '0 6 * * 1'
+
+  # Run the scan on demand instead of waiting for the next cron tick.
+  workflow_dispatch:
+
 permissions:
   contents: read