Add image scanning to pipeline

[petewall]

We only build one image, and it's only for testing.
However, we should extract the images that are included and scan them anyway. That way, we can be on-top of issues before they become a problem to us.

Prior art:
#825
https://github.com/grafana/grafana/blob/main/.github/workflows/trivy-scan.yml