add docker image scanning

.github/workflows/docker-publish.yml

@@ -58,6 +58,15 @@ jobs:
         run: nix build .#ociImage
       - name: Load Docker image
         run: docker load < result
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          image-ref: 'ghcr.io/$IMAGE_NAME'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
       - name: Push image to registry
         if: github.event_name != 'pull_request'
         run: docker push ghcr.io/$IMAGE_NAME -a