feat: add version-file input to pin the Trivy version from a file

[somaz94]

Adds a version-file input so the Trivy version can come from a file instead of being hard-coded in the workflow. It reads the asdf .tool-versions layout (the trivy entry) or a plain version file, and takes precedence over version when set. This follows the *-version-file convention used by setup-go, setup-node and similar setup actions.

Both the cache keys and the install step now use the resolved version, so caching keeps working unchanged.

Validation (run locally):

• shellcheck on the embedded resolve step: clean
• actionlint on the updated workflow: clean
• Ran the resolve logic against 9 cases under bash -eo pipefail: .tool-versions (multi-tool, with and without a leading v), a plain version file (including comment and blank lines), version-file taking precedence over version, plus missing-file and no-version-found both erroring out as expected.

A new version-file CI job installs Trivy on ubuntu/windows/macos from both a .tool-versions and a plain file for the full end-to-end check.

[somaz94]

Friendly nudge on this one — it's been a few weeks. This adds an opt-in version-file input to pin the Trivy version (mirrors the common setup-* action pattern); CI is green. Happy to tweak anything if it helps. Thanks!

[somaz94]

Open since June with no review. Is a version-file input for pinning Trivy something you want here? Happy to close if not, otherwise it is green and ready.