feat: build, scan, and push

[mawinkler]

Description

This is a redesigned more complete GitHub Action Workflow.

Major benefits are that the registry does not get polluted by vulnerable images or images with malware, the scan result and SBOM are always stored as artifacts, and admission control is fully supported based on scan results.

Proposed Changes

• Not using a scan container but triggering the scan inline allows easier adaption.
• Scanning the built image first as a tarball allows security analysis without pushing to a registry.
• Different handling of vulnerability thresholds by setting the maximum criticality for vulnerabilities. A threshold set to high allows any number of medium or lower criticalities, but no high or higher vulnerabilities.
• Finishing the workflow by a registry scan allows integration with admission control.
• Support for scanning for malware or vulnerabilities only.

Type of change

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist before requesting a review

• I have performed a self-review of my code

[felipecosta09]

@mawinkler I think there are missing updates in the scripts, right?

I only see changes in the README

error