🌱 setup Trivy scanning for supported release branches

[ykakarap]

What this PR does / why we need it:

This PR adds Trivy scanning job to all supported release branches.

By default on: schedule jobs only run on the default branch. Copying this workflow to release branches does not trigger the job on the release branches.

Additional notes:
With this we can drop the scan.yaml files from the release branches to avoid confusion as they currently do not do anything.
scan.yaml was added in in the following PRs:

• [release-1.3] ✨ Adds a verify script that run trivy scanner on container images #7820
• [release-1.2] ✨ Adds a verify script that run trivy scanner on container images #7821

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[sbueringer]

With this we can drop the scan.yaml files from the release branches to avoid confusion as they currently do not do anything.
scan.yaml was added in in the following PRs:

@ykakarap The jobs on the release branches are currently not doing anything, right?

I would probably just keep them there. Otherwise would the idea be that as soon as we branch away a release branch in the future we would have to delete the scan.yaml?

(we can still clean them up now if we want as they never worked, but if not necessary I would prefer to not making this a pattern going forward)

[sbueringer]

Thx for taking care of this, just a few nits

[killianmuldoon]

/lgtm

(pending nits)

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 8638434b09bedcca25b7cadaaeec26456f1c83f8

[ykakarap]

@ykakarap The jobs on the release branches are currently not doing anything, right?

Yes.

I would probably just keep them there. Otherwise would the idea be that as soon as we branch away a release branch in the future we would have to delete the scan.yaml?

Sounds good. Let's just keep them.

[sbueringer]

/lgtm
/assign @fabriziopandini

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: cfdf8e4c01ed2c6565a3591cdff2866efeccc776

[fabriziopandini]

Thanks @ykakarap for tacking care of this, really appreciated!
/lgtm
/approve

[ykakarap]

Rebased to resolve merge conflicts.

[sbueringer]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 1204be7539dba4f86c895e9a3d365a3010cf207b

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fabriziopandini, sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [fabriziopandini,sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ykakarap]

Update: Yesterdays scan ran on all three supported branches. The changes is working as desired.

https://github.com/kubernetes-sigs/cluster-api/actions/runs/3930140568