feat(security-scan): add SARIF upload to docker and ECR security scans

[davidf-null]

Summary

• Adds SARIF upload to docker-security-scan workflow so vulnerability results are visible in the GitHub Security tab
• Adds SARIF upload to ecr-security-scan workflow with per-image SARIF files uploaded as a directory
• Both workflows get security-events: write permission and a new upload_sarif input (default: true) to opt out if needed

Changes

docker-security-scan.yml

• Added security-events: write permission
• Added upload_sarif input (boolean, default true)
• Main scan runs with continue-on-error: true so SARIF generation is not skipped on failure
• New step generates SARIF via a second Trivy pass
• New step uploads SARIF to Security tab with category: trivy-docker-{image_name}
• Explicit fail step based on original scan outcome

ecr-security-scan.yml

• Added security-events: write permission
• Added upload_sarif input (boolean, default true)
• SARIF generated per image inside the scan loop → sarif-results/{IMAGE_NAME}.sarif
• New step uploads the sarif-results/ directory (CodeQL action supports multi-file directories)

Test plan

• Trigger docker-security-scan on a repo with known vulnerabilities and verify results appear under Security → Code scanning
• Trigger ecr-security-scan and verify per-image SARIF results appear in Security tab
• Verify upload_sarif: false skips the SARIF steps without breaking the scan

🤖 Generated with Claude Code