devops: reusable dockerfile scan workflow

[landsman]

Same idea as semgrep.yml: one copy of the scan here, every repo with a Dockerfile calls it.

jobs:
  dockerfile:
    uses: landsman/config/.github/workflows/dockerfile.yml@main
    with:
      dockerfile: github-runner/Dockerfile

That replaces the two trivy-action steps currently pasted into the caller.

The base image is read off the FROM line, not passed in. A tag written both in the workflow and in the Dockerfile drifts silently green — Dependabot bumps the Dockerfile, the workflow keeps scanning last year's image and keeps passing. The image: input stays for the one case that cannot be read: a FROM assembled from an ARG.

Multi-stage takes the last FROM that is not an earlier stage, which is the image the container actually runs on; --platform= flags and scratch are handled. Parser checked against nine Dockerfile shapes before committing.

Both scans exit 1 on a finding. Trivy's default is exit 0 with the findings printed, which is a check that cannot fail — this is a behaviour change from the pasted version, whose config step could not go red. CRITICAL,HIGH on both, so the misconfig scan does not fail on style.

Named for what it checks rather than for trivy, so replacing the scanner later does not rename the job in every caller.