Add Docker security scanning with trivy
Add Docker security scanning with trivy

I came across trivy in ThoughtWorks' technology radar:
https://www.thoughtworks.com/radar/tools?blipid=201911077

> Our teams particularly like Trivy, a vulnerability scanner for
> containers, because it's easier to set up than other tools, thanks to
> it shipping as a stand-alone binary.

Stand-alone setup sounded like a good fit for our use-case, so I decided
to give it a try.

Currently, only critical severity problems cause a pipeline failure and
_only_ production requires the scan to pass.

ministryofjustice/laa-legal-adviser-api,ministryofjustice/laa-legal-adviser-api,ministryofjustice/laa-legal-adviser-api