Repo cleanup

[qboileau]

• Add missing LICENSE/NOTICE/PROVENANCE on repackages dependencies like cortex/prometheus/supervisord/confluent kafka tools
• reduce permission and secrets used in CI workflows
• cleanup docs

[github-actions]

Container image CVE report

base-jre-25

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 9	9

Grype critical+high by component

Component	Findings
busybox 1.38.0-r1	3
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2

base-monitoring

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 10	14

Grype critical+high by component

Component	Findings
busybox 1.38.0-r1	3
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2
go.etcd.io/etcd/client/pkg/v3 v3.5.17	1

base-os

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 3	3

Grype critical+high by component

Component	Findings
busybox 1.38.0-r1	3

debug

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 26	37

Grype critical+high by component

Component	Findings
stdlib go1.25.12	12
busybox 1.38.0-r1	3
jline-remote-telnet 3.30.4	2
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2
golang.org/x/net v0.55.0	1
golang.org/x/text v0.37.0	1

_{Trivy counts fixed vulnerabilities only; Grype includes unfixed, so its totals run higher. Full reports are in the workflow artifacts.}