fix(security): validate vulnerability scans and pin scanner downloads

docs/VULNERABILITY_SCANNING.mdadded+26-0

Changes to docs/VULNERABILITY_SCANNING.md

		@@ -0,0 +1,26 @@
	1	+# Vulnerability scan interpretation
	2	+
	3	+The SBOM workflow scans the repository inventory, including development tools,
	4	+benchmark comparison applications and CI dependencies. It is not a runtime-only
	5	+inventory and a match does not by itself establish reachability in a shipped app.
	6	+
	7	+The scanner must complete successfully and produce a populated-inventory report
	8	+with valid database metadata. Missing output, malformed JSON, unexpected report
	9	+shapes and scanner failures fail the job; none are interpreted as zero findings.
	10	+The text report and severity counts are derived from the same JSON scan.
	11	+Artifacts are retained on failure when the scanner produced diagnostic output.
	12	+Each attempt removes previous JSON and text reports before validating its input.
	13	+A failed rerun therefore cannot attach a previous successful summary alongside
	14	+new diagnostics. Keep the input SBOM separate from the scanner's output files.
	15	+
	16	+The existing severity policy is unchanged: Critical findings fail the check;
	17	+High findings emit an explicit warning and remain release-review items. A green
	18	+scan is **not** release approval. Issue [#279](https://github.com/craft-native/craft/issues/279)
	19	+tracks the reviewed High/Critical policy and shipping-scope analysis; issue
	20	+[#276](https://github.com/craft-native/craft/issues/276) tracks locked dependency
	21	+advisories. No baseline or vulnerability exemption is added by this workflow.
	22	+
	23	+Syft and Grype Linux x64 downloads are pinned by release version and SHA-256 in
	24	+`.github/workflows/sbom.yml`. Tool updates must update both the asset URL and its
	25	+digest using the upstream release metadata, then run the scanner regression
	26	+tests and a real workflow scan. Mutable installer scripts are not executed.