Scan the built image for vulnerabilities and fix what's fixable (#29)

* Scan the built image for vulnerabilities and fix what's fixable

Ran trivy against the built image locally: 67 HIGH/CRITICAL findings,
65 of them in debian:bookworm-slim packages with no upstream fix yet.
The remaining 2 were both setuptools 66.1.1 (CVE-2024-6345,
CVE-2025-47273) — bundled by ensurepip when the venv is created, not
pinned by requirements.txt, so nothing was upgrading it.

- Upgrade setuptools to >=78.1.1 in the Dockerfile, which fixes both
  CVEs. Verified with a local rebuild + rescan: 0 HIGH/CRITICAL
  fixable findings remain.
- Add a Trivy scan step to the CI `test` job, after the smoke test.
  Uses --ignore-unfixed so the build fails only on findings this repo
  can act on, not on upstream Debian CVEs with no available patch.
- Check off the corresponding P0 item in IMPROVEMENTS.md; note that
  scheduled (as opposed to PR/push-triggered) scanning is still open.

* Fix trivy-action tag (needs v prefix)

* Tighten scan-coverage wording per review

Copilot review on PR #29 flagged "every pull request and push" as
ambiguous: the test job's push trigger is scoped to master and tags,
not every branch. Spell that out.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

.github/workflows/docker-publish.yml

@@ -57,6 +57,18 @@ jobs:
       - name: Container smoke test
         run: tests/smoke.sh ${{ env.IMAGE }}:ci
 
+      # ignore-unfixed: the debian:bookworm-slim base carries CVEs with no
+      # upstream fix yet; failing on those would block every build on
+      # findings nothing in this repo can act on. A fixable HIGH/CRITICAL
+      # finding still fails the build.
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: ${{ env.IMAGE }}:ci
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: '1'
+
   push:
     needs: [unit-test, test]