Add a Trivy job to the Docker build workflow that scans the built image
for CRITICAL/HIGH CVEs, uploads SARIF to GitHub code scanning, and fails
only on CRITICAL findings so a solo maintainer isn't blocked by HIGH-only
noise. Split top-level workflow permissions down to contents:read and
elevate packages:write / security-events:write per job instead of at the
workflow level. Strip npm/npx/yarn/corepack from the Docker runtime stage
since they are never invoked at runtime (node server.js only) and were
the source of the only CRITICAL/HIGH findings in the current image.
James Maes