ci: integrate Trivy code scanning in PR workflows

- Add a code scanning job using Trivy to check for CRITICAL and HIGH severity vulnerabilities during PR workflows

Signed-off-by: appleboy <appleboy.tw@gmail.com>

.gitea/workflows/test-pr.yml

@@ -23,4 +23,19 @@ jobs:
         uses: golang/govulncheck-action@v1
         with:
           go-version-file: 'go.mod'
-          go-package: ./...
+          go-package: ./...
+
+  code-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Trivy vulnerability scanner in repo mode
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '1'
+          severity: 'CRITICAL,HIGH'