ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)

security/trivyignore.txt

@@ -0,0 +1,5 @@
+# Accepted container image vulnerabilities (Trivy ignore file).
+#
+# One vulnerability id per line (CVE-...). Every entry needs a comment above it with
+# the reason and the date it must be reviewed, and a row in the waiver table of
+# docs/security.md. Empty means nothing is ignored.