ci: add re-usable workflow for scans from published img and automatic…

[DnPlas]

This commit adds get-published-images-scan-and-report.yaml, a re-usable workflow that enables repositories to scan images from a public registry (in the case of the Analytics team it defaults to charmedkubeflow) and reports back the security vulnerabilities as Github issues.
This workflow is intended to be used on demand (using a workflow dispatch) and on schedule, as it will be used for continuous testing of the published images a rock repository generates.

Part of #69

For reviewers

This workflow has been tested in this fork, specifically here.

In general, we'd expect rock repositories to have exactly the same workflow for scheduled and on demand scans:.

name: Scan images

on:  
  schedule:
    - cron: '00 23 * * *' # <-- run every day at 23:00
  workflow_dispatch: # <-- also allow to run on demand

jobs:

  on-push:
    name: Get rocks modified and build-scan-test-publish them
    uses: canonical/charmed-kubeflow-workflows/.github/workflows/get-published-images-scan-and-report.yaml@main
    strategy:
      matrix:
        branch: [main, track/1.8] # <-- select the branches to scan for this repository
    secrets:
      GH_TOKEN: ${{ secrets.GH_TOKEN }} # <-- required to create and edit GH issues
    with:
      report-vulnerabilities: true # <-- required to enable the automatic reports
      severity: "HIGH,CRITICAL" # <-- the severity of vulnerabilities to report
      branch: ${{ matrix.branch }}

[orfeas-k]

Good job @DnPlas, left some comments:)

[orfeas-k]

Some last comments, good job with the refactoring