deps: bump bundled scanners to trivy 0.73.0, grype 0.116.1, syft 1.50.0

[tyler-rich]

Summary

Moves the bundled scanner binaries to their current upstream releases — Trivy 0.72.0 → 0.73.0, Grype 0.115.0 → 0.116.1, Syft 1.46.0 → 1.50.0 — as their own PR, since the ARG TRIVY_VERSION / GRYPE_VERSION / SYFT_VERSION build args are invisible to every Dependabot ecosystem (they are not FROM images; the queue-audit §14 entry records this gap).

Each target version was verified as the current release by resolving the projects' tags directly (git ls-remote), not taken from any summary. Release notes for every release crossed (trivy 0.73.0; grype 0.116.0, 0.116.1; syft 1.47.0–1.50.0) document no breaking changes, deprecations, or CLI changes, and Syft's JSON schema moves only at patch level (internal/constants.go: 16.1.5 → 16.1.10 at the two tags), so Scrye's JSON parsing and persisted-SBOM format are unaffected.

What moves in lockstep, and why

• docker/Dockerfile — the three ARGs. Layer structure untouched (version-only edits inside the existing scanners stage).
• .github/workflows/ci.yml + rescan.yml — the dogfood/re-scan aquasec/trivy and anchore/grype image pins. The comment above them says they are "pinned to the version Scrye bundles", so leaving them behind would falsify it. New digests resolved from the Docker Hub registry API; as a methodology check, the old tags were re-resolved first and matched the committed pins exactly.
• THIRD_PARTY_LICENSES/ — re-verified fresh at the new tags, per the Apache-2.0 §4 rule that the real text travels with the distribution: each bundled LICENSE (and Trivy's NOTICE) fetched at v0.73.0 / v0.116.1 / v1.50.0 and cmp'd byte-for-byte against what is committed — all identical, and Grype/Syft still 404 on NOTICE (expected, documented). Only the version table changes.
• README.md § Integrations version list, and a CHANGELOG.md [Unreleased] § Changed entry.

Verification

• tests/test_scanner_symlink_containment.py re-run locally against the real downloaded syft 1.50.0 and grype 0.116.1 binaries on CPython 3.14.6 with SCRYE_TEST_REQUIRE_SCANNER_BINARIES=1: 7 passed. (Required on every Grype/Syft bump — CONTRIBUTING.md § Tests that need the real scanner binaries. CI's image job repeats it against the binaries the image actually ships.)
• The full backend suite passes on CPython 3.14.6 in this environment (728 passed, 11 skipped) — no backend code changes here.
• Cosign + checksum verification of the release tarballs is unchanged in the Dockerfile and exercised by CI's image build.

Resolves the "bundled scanner binaries are stale and nothing watches them" finding from the Dependabot queue audit (#159). #150 (the optional trivy-server sidecar in docker/docker-compose.yml, 0.72.0 → 0.73.0) is the compose-side counterpart and can now be taken, since the sidecar and bundled versions move together.