IT-3921: Rebuild container when Trivy code scan fails

[brucehoff]

This repo' runs a daily scan of the built container image using Trivy and reports its findings to on the repo's Security tab. When findings appear they can almost always be addressed simply by rebuilding the image, which picks up updates to the dependencies. In this way rebuilding the Docker image is analogous to patching a linux server.

This PR adds logic to the daily scan to automatically trigger a rebuild of the image when the scan fails, by incrementing the semvar tag. If the rebuild is successful an updated image will be pushed to ghcr.io. If the rebuild fails to address the findings then no new image will be pushed, and instead the IT team will see the findings in the Security tab, and investigate, following our current process.

[ConsoleCatzirl]

awesome, I really like this approach