refactor: CVE summary in PR/CI and badges with now more details report

[qboileau]

• Add details on Critical/High/Medium/Low severity CVEs on PR/CI summary/Badges
• Create cve-lib.sh for CI to generate reports
• Generate full scanner reports on badge branch alongside badge config
• Add link on README badges to the full report directly

[github-actions]

Container image CVE report

base-jre-25

Scanner	Critical	High	Medium	Low	Total
Trivy	✅ 0	✅ 0	0	0	0
Grype	✅ 0	✅ 0	0	0	0

base-monitoring

Scanner	Critical	High	Medium	Low	Total
Trivy	✅ 0	✅ 0	3	0	3
Grype	✅ 0	🟠 1	4	0	8

Grype critical+high by component

Component	Findings
go.etcd.io/etcd/client/pkg/v3 v3.5.17	1

base-os

Scanner	Critical	High	Medium	Low	Total
Trivy	✅ 0	✅ 0	0	0	0
Grype	✅ 0	✅ 0	0	0	0

debug

Scanner	Critical	High	Medium	Low	Total
Trivy	✅ 0	🟠 12	4	0	16
Grype	✅ 0	🟠 17	10	0	28

Grype critical+high by component

Component	Findings
stdlib go1.25.12	12
jline-remote-telnet 3.30.4	2
golang.org/x/net v0.55.0	1
golang.org/x/text v0.37.0	1
jetty-security 12.0.34	1

_{Trivy counts fixed vulnerabilities only; Grype includes unfixed, so its totals run higher. Totals cover every severity, so they exceed C+H+M+L where a scanner also reports negligible or unknown. Full reports are in the workflow artifacts.}