ci: clear the Trunk findings on the image scan workflows

aquasecurity's IP allow list rejects GitHub API calls from hosted
runners, so pinact 403s verifying the trivy-action tag comment. A
.pinact.yaml rule skips verification for aquasecurity actions only once
they are pinned to a full SHA, so an unpinned ref is still flagged.

zizmor (enabled on master) wants the $/ self-repository syntax for the
reusable workflow call, but actionlint 1.7.12 rejects it, so the finding
is suppressed inline for now.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

.github/workflows/build.yml

@@ -291,7 +291,8 @@ jobs:
       contents: read
       packages: read
       security-events: write
-    uses: ./.github/workflows/image-scan.yml
+    # actionlint doesn't understand the $/ self-repository syntax yet.
+    uses: ./.github/workflows/image-scan.yml # zizmor: ignore[self-repository]
     with:
       images: >-
         ["ghcr.io/${{ github.repository_owner }}/romm:${{ needs.merge.outputs.version }}",

.pinact.yaml

@@ -0,0 +1,8 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+version: 3
+rules:
+  # aquasecurity's IP allow list rejects API calls from GitHub-hosted runners,
+  # so skip verifying the tag comment once the action is pinned to a SHA.
+  - ignore: true
+    conditions:
+      - expr: ActionRepoOwner == "aquasecurity" && ActionVersion matches "^[0-9a-f]{40}$"