also looking at this

fix(security): validate vulnerability scans and pin scanner downloads

#300

Merged glennmichael123 wants to merge codex/failure-safe-vulnerability-scan into main

5 files +192 -56

26f923eecc fix(security): fail closed on vulnerability scanner errors glennmichael123 review this step
036d2e80ba fix(sbom): discard stale reports before every scan glennmichael123 review this step