fix(ci): install a pinned and checksum-verified trivy instead of the apt repository - #772

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❌ Your project check has failed because the head coverage (64.06%) is below the target coverage (70.00%). You can increase the head coverage or adjust the target coverage.
see 17 files with indirect coverage changes