chore: migrate from Trivy to Grype for vulnerability scanning

[JAORMX]

Summary

• Replace aquasecurity/trivy-action with anchore/scan-action (Grype) v7.3.2 for vulnerability scanning
• Grype provides equivalent vulnerability detection capabilities
• Remove IaC/config scan job (not supported by Grype)

Test plan

• Verify Grype scan runs successfully in CI
• Check that SARIF results appear in Security tab

🤖 Generated with Claude Code

In general, the fix is to explicitly declare a permissions block in the workflow, using the least privileges needed. For a security scanning job that checks out the code and uploads SARIF results to GitHub’s Security tab, the job needs read access to the repository contents and security events. The minimal and appropriate set is typically contents: read and security-events: write (the latter is required for uploading SARIF).

The best way to fix this without changing functionality is to add a permissions block at the job level under grype-scan:. This scopes the permissions just to this job and avoids affecting any other jobs that might be added later. Concretely, in .github/workflows/security.yml, under jobs:, and indented to align with runs-on, add:

permissions:
  contents: read
  security-events: write

This preserves the workflow’s behavior (checkout still works; SARIF upload still works) while constraining the GITHUB_TOKEN to only what is needed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.