Add action or workflow for image scanning

[devtobi]

Solution for image scanning must be found.
Ideally before tagging images tolatest or doing a release, the image (e.g. labelled unstable) should be tested.

[hupling]

https://artifacthub.io/packages/helm/it-at-m/refarch-gateway?modal=security-report Images werden hier gescannt auf Artifcthub

[devtobi]

Great, does this only work for helm charts or also for individual docker images. I think before creating or updating a helm chart with image versions, we should make sure the images themselves are "safe". If we only get this information after updating the helm chart, this is too late in my opinion.

[hupling]

The internal Openshift-Team wants to install rhacs (stackrox). So all images are scanned interanal

[klml]

@hupling regardless of whether we have to scan images internally or not, we also have to scan them publicly here!