ci: scan the distribution tree for known vulnerabilities (#851)

Adds a Trivy scan of the built app tree, using the reusable workflow. It runs on
pushes and pull requests and, more importantly, weekly: most findings appear when
a CVE is published against code that was released long ago, with no repository
activity to trigger CI.

The scan fails on HIGH and CRITICAL findings that have a fix available.

It scans the unpacked distribution tree with `trivy rootfs` rather than the
checkout with `trivy fs`, because the fs scanner does not run Trivy's gobinary
analyzer and dependencies only exist after the build.

Signed-off-by: Thomas Müller <[email protected]>

Author: DeepDiver1975

.github/workflows/security-scan.yml

@@ -0,0 +1,28 @@
+name: Security Scan
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  schedule:
+    # Weekly, so CVEs published against already-released code surface without a
+    # code change. That is how the outdated bundled rclone would have been found.
+    - cron: '0 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trivy:
+    name: Trivy
+    uses: owncloud/reusable-workflows/.github/workflows/trivy.yml@main