Add Chef Automate Container Scanning and Remove Trivy Integration

[peter-at-progress]

Description

This PR introduces two major changes to the vulnerability scanning workflow:

1. New: Chef Automate Container Scanning Mode

Adds a complete GitHub Action for scanning Chef Automate's embedded Habitat packages in containerized environments:

• New action: automate-container-scan - Deploys Chef Automate in a Docker container with systemd support, then scans embedded Habitat packages from both chef and core origins using Grype
• Generates structured JSON vulnerability reports compatible with the Chef vulnerability dashboard
• Supports both stable and current release channels
• Captures comprehensive metadata including deployment logs, scan results, and installation size metrics
• Produces organized output structure under out/container/automate/{channel}/{os}/{version}/{arch}/

Key features:

• Containerized Automate deployment with proper systemd initialization
• Separate scans for chef and core Habitat origins
• Integration with download license requirements
• Comprehensive logging and error capture
• Size tracking for installed packages

2. Breaking: Complete Removal of Trivy Integration

Permanently removes all Trivy-related functionality from chef-download-grype-snapshot action following the second Trivy security compromise (March 2026):

• Removed all Trivy installation, scanning, and comparison logic (~211 lines removed from run.py)
• Removed Trivy-related action inputs: enable_trivy, trivy_scanners, trivy_severity, trivy_ignore_unfixed, trivy_timeout, trivy_cache_dir
• Removed Trivy output files.
• Updated documentation to reflect Grype-only scanning
• Added security notice to README explaining removal rationale

All vulnerability scanning is now performed exclusively by Grype for improved security posture and consistency.

3. New: Database Integration for Vulnerability Trends

Adds insert-scan-results action for PostgreSQL-backed vulnerability analytics:

• Inserts scan results into trend tables (native_scan_results, habitat_scan_results, container_scan_results)
• Upserts CVE detail records tracking first/last observed dates per CVE × package × product × channel
• Supports all scan modes: native, modern, habitat, and container
• Idempotent operations using ON CONFLICT - safe for workflow retries
• Non-blocking: DB failures generate warnings but don't fail scan workflows
• Includes skip_trend_insert option for test/on-demand scans

4. Additional Enhancements

• Smart version matching: Documented the version-aware scanning logic in README
• Habitat dependency separation: Enhanced Habitat scans to categorize vulnerabilities by dependency type (build/runtime)
• Build number capture: Records CLI build numbers for better traceability
• Download site categorization: Added download_site dimension (commercial/community/cinc) for database tracking
• Auth token fallback: Improved HAB_AUTH_TOKEN handling for protected Habitat channels
• Error logging: Enhanced error capture and debugging output
• Pre-flight checks: Skip Automate CLI version checks to avoid blocking installations

Related Issue

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Breaking changes:

• Removal of all Trivy-related inputs and outputs from chef-download-grype-snapshot action
• Workflows using enable_trivy or other Trivy parameters must be updated
• Output structure no longer includes trivy.latest.json, trivy.metadata.json, or compare.json files

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.

[brianLoomis]

looks good