refactor!: enforce an optimize single platform docker-build with failure on CRITICAL or HIGH fixed vulnerabilities detection

[jbern0rd]

Note

Medium Risk
Changes the docker build workflow execution order (build->scan->push) and tightens security gating, which may newly fail builds or alter multi-arch publishing behavior.

Overview
Updates the reusable docker-build GitHub Actions workflow to build a single platform image (new platform input replacing platforms), load it on the runner, and delay pushing until after security checks.

Upgrades Trivy and switches scanning to image-ref instead of a saved tarball, adds input validation for platform and security-report, and introduces a dedicated Trivy run that fails the job on CRITICAL,HIGH vulnerabilities (with ignore-unfixed: true) before pushing. PR comment text is adjusted to include the platform, and the README is updated to document the single-platform limitation and new input.

^{Written by Cursor Bugbot for commit 359da29. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}