[Feature]: scheduled CVE rescan of published images until EOL (after v4) #61

Summary

Keep scanning published images for new CVEs until they reach EOL. trivy-image-scan only scans at build time (pr-<N> on PRs, the v* tag on tag pushes), so a CVE disclosed after a release never shows up for images that are already published.

Out of scope for the v4 stack; to be picked up right after v4 is released.

Plan

• Add a scheduled rescan of published release images.
• Decide which tags count as supported (not EOL) and scan only those.
• Report findings the same way as the build-time scan (SARIF to GHAS, a category per image).

Context

Raised in #44 (comment).