podman-build-publish: gate pushes on a Trivy vulnerability scan

New scan step between build and push: the built image is exported and
scanned with Trivy; fixable HIGH/CRITICAL findings fail the action and
block the push. Configurable via new scan / scan-severity inputs.
Implements noctrl.podman security review finding #16 (CI level).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

README.md

@@ -8,6 +8,8 @@ Reusable Gitea Actions composite workflows for noctrl infrastructure automation.
 
 Builds and optionally pushes OCI container images to `registry.noctrl.eu` using Podman with isolated storage context.
 
+Since `v10`, the built image is scanned with Trivy before the push and the action fails on fixable HIGH/CRITICAL vulnerabilities (tune with `scan-severity`, opt out with `scan: "false"`). Requires the `trivy` binary on the runner (present in `noctrl/gitea-runner` since `v9`).
+
 **Location:** [`./podman-build-publish`](./podman-build-publish)
 
 **Use in workflows:**