ci: image collection and scanning

[davrad]

📝 Summary

This PR adds image scanning and Trivy analysis to the CI.
In addition it updates the goreleaser schema to include an image section into the header, such that in each release, all the image versions of the standard kubara catalog are also listed.

🧩 Type of change

• 🔧 CLI / Go code
• 📦 Helm chart
• 🧱 Terraform module
• 📝 Documentation
• 🧪 Test or CI change
• ♻️ Refactor / cleanup

⚠️ Is this a breaking change?

• Yes, this change breaks existing functionality (explain in summary)

🧪 Testing

• CI passed
• Manually tested (local/dev cluster)
• Unit tested
• Not tested (explain why below)

🔗 Related Issues / Tickets

✅ Checklist

• Code compiles and passes all tests
• Linting and style checks pass
• Comments added for complex logic
• Documentation updated (if applicable)

📎 Additional Context (optional)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[tuunit]

I think the current profiles don't activate all components. We need to render all our charts. At the moment the report is missing metrics-server, longhorn, loki, external-dns, metallb, velero

[davrad]

The Pipepiline currently runs into Caching issues.

Caching issues were addressed.