remove dependency on github.com/aquasecurity/trivy

[majewsky]

This fixes trivy forcing a toolchain directive down our throats.

Note: The diff in the enriched report JSON fixture is because we marshal through map[string]json.RawMessage instead of map[string]any, so field order from the original input is retained instead of all objects being sorted by key.