ci: gate Trivy on HIGH/CRITICAL only (limit-severities-for-sarif)

The Trivy job failed even with zero HIGH/CRITICAL findings. Ground truth from
the uploaded SARIF: 8 results, all LOW (rand/lru/rpassword advisories). In
SARIF mode the trivy-action overrides the severity filter to all severities so
the report is complete for code scanning, and exit-code: 1 then fires on ANY
finding in it — including those LOW ones.

limit-severities-for-sarif: true makes the HIGH,CRITICAL filter apply to the
SARIF and the exit code, so the job gates only on HIGH/CRITICAL (currently 0) —
the LOW rust-dep advisories are already tracked by cargo-audit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: radicalkjax

.github/workflows/container.yml

@@ -86,6 +86,12 @@ jobs:
           output: trivy.sarif
           severity: HIGH,CRITICAL
           exit-code: '1'
+          # CRITICAL: in SARIF mode `severity` does NOT filter the report, and
+          # `exit-code` then fires on ANY finding in it (including LOW). This
+          # makes the severity filter apply to the SARIF + exit-code, so the
+          # job gates only on HIGH/CRITICAL — not the LOW rust-dep advisories
+          # (rand/lru/rpassword) which cargo-audit already tracks.
+          limit-severities-for-sarif: true
           # Only fail on FIXABLE vulnerabilities — un-actionable upstream
           # base-OS CVEs (debian "wont-fix") can't be patched from here and are
           # picked up automatically when the distroless base is rebuilt.