fix(ci): stabilize Trivy code scanning categories

[jkim323]

Trivy scans and SARIF ingestion are healthy, but each uploaded analysis category includes an image slug derived from the full image reference and a hash that includes the digest. Updating an image tag or digest therefore creates a new Code Scanning configuration instead of continuing the existing logical image lane.

The repository currently has 25 distinct historical Trivy categories despite scanning a much smaller active image set. This clutters the Trivy tool status page with obsolete configurations and fragments alert history across image updates. Across 694 inspected Trivy analyses, SARIF processing succeeded with no ingestion errors, so this issue concerns configuration identity rather than scanner reliability.

Steps to Reproduce

1. Record the Trivy category produced for a digest-pinned base image.
2. Update that image to a new tag or digest.
3. Run the container scan again.
4. Observe that GitHub Code Scanning creates a new Trivy configuration while retaining the previous category as historical status.

Expected Behavior

Each logical image scan lane retains one stable Code Scanning category across tag and digest updates, while per-run artifact filenames remain collision-resistant and concurrent images retain distinct identities.

Acceptance Criteria

• Separate the stable Code Scanning category identity from the digest-specific artifact filename slug.
• Keep each category stable when only an image tag, patch version, or digest changes within the same logical scan lane.
• Keep categories unique for distinct images scanned concurrently, including equivalent references with different registry notation.
• Preserve collision-resistant SARIF artifact filenames for each concrete image reference.
• Add validation for digest changes, tag changes, registry aliases, and multiple images in one matrix run.
• Confirm a default-branch container scan uploads all current analyses without creating additional categories for unchanged logical lanes.
• Document any one-time handling required for historical categories that GitHub already retains.