feat(sec-pipeline): implement unified container scanning architecture and SAST integration

[moghit-eou]

• Consolidate SAST (Hadolint/OpenGrep) and SCA (Trivy/OSV) into a single Python orchestrator.
• Implement unified SARIF merging for centralized GitHub Security tab reporting.
• Refactor setup-tools.sh to use modular CLI flags (--install-tool, --sbom-ecosystem) for dynamic binary installation.
• Standardize pipeline failure gates across both qualitative severity and CVSS scores.

Follows OWASP DevSecOps guidelines for Dockerfile/container hardening.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

This PR updates the repository’s security automation by refactoring the GitHub Actions security workflows and adding Python-based orchestrators for SCA/SAST and container scanning, alongside a small Docker hardening change and dependency override bumps.

Changes:

• Added new GitHub Actions workflows for SAST and container scanning; refactored SCA workflow to use the new tooling and naming.
• Refactored .github/scripts/setup-tools.sh to support modular tool installation and SBOM generation via flags, and introduced new orchestrator scripts (sca_scan.py, sast_scan.py, container_scan.py).
• Hardened the runtime container by switching nginx to run as a non-root user and fixing ownership of required paths.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
package.json	Bumps overrides for shell-quote and webpack-dev-server.
package-lock.json	Lockfile updates aligned with override bumps and transitive dependency updates.
Dockerfile	Runs nginx as non-root and adjusts filesystem ownership for runtime writes.
.github/workflows/sca.yml	Renames SCA workflow and switches to new tool setup + sca_scan.py; uploads merged SARIF as artifact.
.github/workflows/sca_image.yml	Removes the old image SCA workflow in favor of the unified container scanning workflow.
.github/workflows/sast.yml	Adds a new SAST workflow that installs OpenGrep + rules and runs sast_scan.py.
.github/workflows/container-scan.yml	Adds a unified container scanning workflow (Docker build + SAST/SCA + SARIF merge).
.github/scripts/setup-tools.sh	Refactors tool setup into --install-tool / --sbom-ecosystem flags and adds new tools (OpenGrep, Hadolint, semgrep-rules).
.github/scripts/sca_scan.py	Renames merged SARIF env var/output and keeps CVSS-based gating via parse_sarif.evaluate.
.github/scripts/sast_scan.py	New app SAST orchestrator using OpenGrep and semgrep community rules.
.github/scripts/container_scan.py	New orchestrator for container SAST (Hadolint/OpenGrep) and SCA (Trivy/OSV) + SARIF merging.
.github/scripts/run_sca_image.py	Removes the legacy image SCA runner (replaced by container_scan orchestration).
.github/scripts/parse_sarif.py	Minor formatting change; still provides the CVSS gate evaluation helper.

Suppressed comments (1)

.github/workflows/sca.yml:71

• PR description mentions unified SARIF merging for centralized GitHub Security tab reporting, but this workflow currently uploads the merged SARIF only as an Actions artifact (not via github/codeql-action/upload-sarif). That means the merged report won’t appear as a consolidated entry in the Security tab.

[jdaln]

@moghit-eou Ready to merge :)