fix(ci): restore third-party Trivy SARIF uploads (GitHub API rejects category field)

[josecelano]

Summary

docker-security-scan.yml currently fails to upload third-party SARIF results in PR runs because the custom gh api call posts a category field to /code-scanning/sarifs, and GitHub now rejects that field with HTTP 422.

As a result, Code Scanning receives only project-image categories and shows this warning on PRs:

• X configurations not found
• Missing configs include prior third-party categories from main

Example warning seen in PR #436:

• docker-third-party-caddy-2.10
• docker-third-party-grafana-grafana-11.4.0
• docker-third-party-mysql-8.0
• docker-third-party-prom-prometheus-v3.0.1
• docker-third-party-torrust-tracker-develop

Evidence

From Upload all third-party SARIF results job logs:

gh: Invalid request.
Invalid input: "category" is not a permitted key. (HTTP 422)
Warning: Upload failed for sarif-third-party-.../trivy.sarif

Only project categories are currently uploaded for the PR ref:

• docker-project-provisioned-instance
• docker-project-ssh-server

Impact

• CI remains green because the step swallows upload errors (|| echo ...).
• Security visibility for third-party images in PR code scanning is degraded.
• PR warning is confusing but does not indicate test/build failure.

Proposed Fix

Replace the custom gh api /code-scanning/sarifs upload loop with a supported mechanism that sets category/configuration reliably:

1. Preferred: use github/codeql-action/upload-sarif@v4 for third-party files as well (including unique category per image).
2. Alternative: set SARIF runAutomationDetails.id per file before upload and use API without category field.

Acceptance Criteria

• Third-party SARIF uploads succeed (no HTTP 422).
• PR code scanning no longer shows missing configuration warnings caused by failed uploads.
• Both old and new third-party categories are handled predictably when image tags change.
• Workflow logs explicitly fail/alert on SARIF upload errors (do not silently ignore).

Related

• Implement Dynamic Image Detection for Vulnerability Scanning #252 (dynamic image detection for vulnerability scanning)
• PR fix: [#428] Docker vulnerability remediation pass 1 (all 8 images) #436 (where warning was observed)