Add various vulnerability scanning configs

[doshitan]

Changes

After recent package updates and other fixes[1][2][3][4], ignore remaining false
positives/things of less immediate concern.

[1] 37ff3d9
[2] 315596d
[3] e2ea148
[4] ef36d7b

Testing

navapbc/platform-test#170

Hadolint before

app-rails/Dockerfile:30 DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
  app-rails/Dockerfile:5[6](https://github.com/navapbc/platform-test/actions/runs/13121306984/job/36607658580#step:6:6) DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
  app-rails/Dockerfile:9[7](https://github.com/navapbc/platform-test/actions/runs/13121306984/job/36607658580#step:6:7) DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
  app-rails/Dockerfile:111 DL300[8](https://github.com/navapbc/platform-test/actions/runs/13121306984/job/36607658580#step:6:8) warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`

Dockle before

FATAL	- CIS-DI-0010: Do not store credential in environment variables/files
	* Suspicious filename found : rails/config/database.yml (You can suppress it with "-af database.yml")
	* Suspicious filename found : usr/local/bundle/ruby/3.3.0/gems/faker-3.3.0/lib/faker/default/omniauth.rb (You can suppress it with "-af omniauth.rb")
	* Suspicious filename found : usr/local/bundle/ruby/3.3.0/gems/devise-4.9.3/lib/devise/omniauth.rb (You can suppress it with "-af omniauth.rb")
INFO	- CIS-DI-0005: Enable Content trust for Docker
	* export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO	- CIS-DI-0006: Add HEALTHCHECK instruction to the container image
	* not found HEALTHCHECK statement
INFO	- CIS-DI-0008: Confirm safety of setuid/setgid files
	* setuid file: urwxr-xr-x usr/bin/newgrp
	* setgid file: grwxr-xr-x usr/bin/chage
	* setgid file: grwxr-xr-x usr/sbin/unix_chkpwd
	* setuid file: urwxr-xr-x usr/bin/gpasswd
	* setuid file: urwxr-xr-x usr/bin/passwd
	* setuid file: urwxr-xr-x usr/bin/chsh
	* setuid file: urwxr-xr-x usr/bin/chfn
	* setuid file: urwxr-xr-x usr/bin/su
	* setgid file: grwxr-xr-x usr/bin/expiry
	* setuid file: urwxr-xr-x usr/bin/mount
	* setuid file: urwxr-xr-x usr/bin/umount
INFO	- DKL-LI-0003: Only put necessary files
	* unnecessary file : usr/local/bundle/ruby/3.3.0/gems/puma-6.4.2/tools/Dockerfile 
	* unnecessary file : rails/docker-compose.yml 
	* unnecessary file : rails/Dockerfile 

Trivy before

/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.217.1/lib/aws-sdk-ssooidc/client.rb (secrets)
==============================================================================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

MEDIUM: JWT (jwt-token)
════════════════════════════════════════
JWT token
────────────────────────────────────────
 /usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.217.1/lib/aws-sdk-ssooidc/client.rb:731 (added by 'COPY /usr/local/bundle /usr/local/bundle')
────────────────────────────────────────
 729       #     access_token: "aoal-YigITUDiNX1xZwOMXM5MxOWDL0E0jg9P6_C_jKQPxS_SKCP6f0kh1Up4g7TtvQqkMnD-GJ
 730       #     expires_in: 1579729529, 
 731 [     #     id_token: "****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************", 
 732       #     issued_token_type: "urn:ietf:params:oauth:token-type:refresh_token", 
────────────────────────────────────────


MEDIUM: JWT (jwt-token)
════════════════════════════════════════
JWT token
────────────────────────────────────────
 /usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.217.1/lib/aws-sdk-ssooidc/client.rb:767 (added by 'COPY /usr/local/bundle /usr/local/bundle')
────────────────────────────────────────
 765       #
 766       #   resp = client.create_token_with_iam({
 767 [     #     assertion: "***********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************", 
 768       #     client_id: "arn:aws:sso::123456789012:application/ssoins-111111111111/apl-222222222222", 
────────────────────────────────────────


MEDIUM: JWT (jwt-token)
════════════════════════════════════════
JWT token
────────────────────────────────────────
 /usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.217.1/lib/aws-sdk-ssooidc/client.rb:776 (added by 'COPY /usr/local/bundle /usr/local/bundle')
────────────────────────────────────────
 774       #     access_token: "aoal-YigITUDiNX1xZwOMXM5MxOWDL0E0jg9P6_C_jKQPxS_SKCP6f0kh1Up4g7TtvQqkMnD-GJ
 775       #     expires_in: 1579729529, 
 776 [     #     id_token: "****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************", 
 777       #     issued_token_type: "urn:ietf:params:oauth:token-type:refresh_token", 
────────────────────────────────────────


MEDIUM: JWT (jwt-token)
════════════════════════════════════════
JWT token
────────────────────────────────────────
 /usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.217.1/lib/aws-sdk-ssooidc/client.rb:801 (added by 'COPY /usr/local/bundle /usr/local/bundle')
────────────────────────────────────────
 799       #     access_token: "aoal-YigITUDiNX1xZwOMXM5MxOWDL0E0jg9P6_C_jKQPxS_SKCP6f0kh1Up4g7TtvQqkMnD-GJ
 800       #     expires_in: 1579729529, 
 801 [     #     id_token: "********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************", 
 802       #     issued_token_type: "urn:ietf:params:oauth:token-type:access_token", 
────────────────────────────────────────