Feat/docker security

[neo7337]

This pull request introduces several improvements to CI/CD security and transparency, as well as documentation and marketing enhancements. The most significant changes are the addition of new security scanning workflows, pinning of GitHub Action versions for supply chain security, and the introduction of a comprehensive marketing plan. Below are the key changes grouped by theme:

Security and Compliance Enhancements:

• Added a new .github/workflows/security.yml workflow to run govulncheck and gosec static analysis on Go code for vulnerability and security scanning on each push and pull request.
• Introduced a .gosec.yaml configuration file to customize gosec scanning, including suppressing a known false positive for zip-slip in the internal/generator package.
• Integrated Trivy vulnerability scanning for built Docker images in the release workflow, with results uploaded to GitHub Code Scanning for both frontend and backend images.
• Added SBOM (Software Bill of Materials) generation steps (SPDX and CycloneDX formats) to the release pipeline for improved supply chain transparency.

CI/CD Supply Chain Hardening:

• Pinned all GitHub Actions in workflow files (backend.yml, frontend.yml, release.yml, security.yml) to specific commit SHAs instead of floating version tags, reducing the risk of supply chain attacks. [1] [2] [3] [4] [5] [6] [7] [8] [9]

Documentation and Project Management:

• Added a detailed PLAN.md outlining the project's marketing strategy, growth phases, content plan, and metrics for tracking success.

Developer Tooling:

• Added a Makefile target (update-digests) to automate checking and updating Docker image digests for base images, improving reproducibility and security of Docker builds.

Workflow Permissions Tightening:

• Explicitly set minimal permissions (permissions: {} or contents: read) in all GitHub Actions workflows to follow the principle of least privilege. [1] [2] [3] [4] [5] [6] [7]

These changes collectively improve the project's security posture, transparency, and readiness for broader adoption and contribution.