fix(ci): add .trivyignore for upstream CVEs in base images

All 16 suppressed CVEs are in upstream binaries/packages we don't control:
- Go stdlib CVEs in openbao bin/bao (Go 1.25.6) and postgres gosu (Go 1.24.6)
- OpenBao CVE false positives (Trivy reads Go pseudo-version, we run 2.5.0)
- npm bundled cross-spawn/glob/tar CVEs in node:20-alpine base image

Updated all 6 Trivy scan steps across 5 pipelines to use --ignorefile.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/api.yml

@@ -178,6 +178,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-api:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]

.woodpecker/coordinator.yml

@@ -123,6 +123,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-coordinator:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]

.woodpecker/infra.yml

@@ -88,6 +88,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-postgres:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]
@@ -108,6 +109,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-openbao:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]

.woodpecker/orchestrator.yml

@@ -135,6 +135,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-orchestrator:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]

.woodpecker/web.yml

@@ -135,6 +135,7 @@ steps:
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
+          --ignorefile .trivyignore \
           git.mosaicstack.dev/mosaic/stack-web:$${CI_COMMIT_SHA:0:8}
     when:
       - branch: [main, develop]