[maya-ots]

What

Adds an opt-in vulnerability scan for images built by mctf build, using Trivy to identify vulnerabilities in container images. This introduces SEC006 and allows users to fail a build when vulnerabilities meet the configured severity threshold, without requiring Trivy for users who don't enable the feature.

Closes #46

How

• Added --scan-vulns to enable vulnerability scanning after images are built.
• Added --vuln-severity to configure the severity threshold, defaulting to HIGH,CRITICAL.
• Implemented Trivy JSON parsing, severity validation, and filtering in internal/build.
• Added tests for JSON parsing, invalid input, severity threshold parsing, and vulnerability filtering.
• Added a clear skip message when Trivy is unavailable.
• Validate the severity configuration before starting the build.
• Documented the new SEC006 rule in docs/spec/validation.md and updated the build command help.

Verification

• go build ./...
• go test ./... fails on Windows in internal/instancer (plugin script execution) and internal/kubernetes (path separator assumptions); the SEC006-related tests pass
• golangci-lint run ./... 0 issues
• mctf generate --check on the sample event (not applicable; no generated files changed)
• Docs updated (docs/spec/validation.md)
• Schema + make schemas synced (not applicable; no schema changes)

Notes

• Trivy is an optional external dependency; vulnerability scanning is disabled by default.
• A build fails when findings meet the configured severity threshold.
• The missing-Trivy skip behavior has been implemented but has not yet been independently verified end to end.
• Full-suite tests and the build check should be completed before merging.