CI: report Trivy misconfiguration findings for changed charts

Adds a trivy-config job to the PR pipeline that renders each changed chart
with Helm and runs `trivy config` over the rendered manifests. Reporting
only - TRIVY_CONFIG_MODE=report always exits 0, so the job never blocks a PR.

Rendered manifests rather than the chart directory: `trivy config <chart-dir>`
renders with default values, which fails on every chart here because of their
required() values - and Trivy does not fail with it, it logs "Skipping chart"
and prints an empty, green report.

Values come from the install-test fixtures (ci/<chart>/test-values.yaml), the
only committed per-chart values in the repo; none of them touches
securityContext, images or capabilities, so the scan sees the chart's own
hardening. Charts without fixtures get ci/trivy/values/<chart>.yaml.

Exceptions live in ci/trivy/trivyignore.yaml in Trivy's native ignore-file
schema, each with a statement - the script refuses to run without one and
reports suppressed findings with their reason instead of hiding them.
AVD-KSV-0125 is configured instead of excepted: ci/trivy/data/ksv0125.yaml
lists the trusted registries, so the check stays able to flag a genuinely
foreign source.

Refs #84.

ci/trivy/values/template-chart.yaml

@@ -0,0 +1,15 @@
+# Render values for the misconfiguration scan only (ci/run-trivy-config.sh).
+#
+# Used for charts that have no ci/<chart>/test-values.yaml because they are
+# excluded from the install-test. template-chart is excluded there for its
+# placeholder image, which a static scan never pulls - so it is still scanned:
+# it is the scaffold every new chart is copied from, and a finding in it is
+# inherited by every chart that follows.
+#
+# Only the values the chart declares `required` - nothing that would change the
+# security posture the scan is meant to look at.
+ingress:
+  domain: scan.example.com
+  clusterIssuer: letsencrypt
+secrets:
+  xxxSecretRef: op://Vault/scan/placeholder