Fix security integration pipeline

[sandhi18]

Description

This pull request updates the .github/workflows/ci-main-pull-request-stub.yml workflow to enhance security scanning, improve version management, and update configuration for downstream workflows. The main changes include adding a job to dynamically read the version from the latest GitHub release, enabling and tightening security and compliance checks (Trivy, Grype, BlackDuck, Polaris), and updating workflow references and parameters for better maintainability and accuracy.

Version management and workflow updates:

• Added a new read_version job that extracts the latest version from GitHub tags and passes it to subsequent jobs, replacing the hardcoded version. Updated the workflow to use a specific version (v1.0.22) of the downstream CI pipeline instead of main.
• Passed new parameters to the downstream workflow, such as github-event-name and github-branch-name, and changed the language parameter value to 'Ruby' (capitalized).

Security and compliance scanning improvements:

• Enabled fail-on-high and fail-on-critical options for Trivy, Grype, Polaris, and BlackDuck scans, ensuring the workflow fails if high or critical vulnerabilities are found. [1] [2] [3]
• Enabled Grype scanning on code and added commented configuration for Grype image and Habitat package scanning for future use.
• Set fail-trufflehog-on-secrets-found to true to ensure the workflow fails if secrets are detected.

Build and linting configuration:

• Disabled complexity checks by default (perform-complexity-checks: false) and clarified SonarQube scan options. [1] [2]

Other configuration changes:

• Commented out the quality-product-name parameter and added new Ruby-specific parameters (ruby-app-directory, run-bundle-install). [1] [2]

These changes collectively improve the workflow's automation, security posture, and maintainability.

Issues Resolved

[List any existing issues this PR resolves, or any Discourse or
StackOverflow discussions that are relevant]

Check List

• New functionality includes tests
• All buildkite tests pass
• Full omnibus build and tests in buildkite pass
• All commits have been signed-off for the Developer Certificate of Origin. See https://github.com/chef/chef/blob/main/CONTRIBUTING.md#developer-certification-of-origin-dco
• PR title is a worthy inclusion in the CHANGELOG

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
1 Security Hotspot
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud