ci: push bundle to Docker Hub registry

[nikpivkin]

This PR adds a checks bundle release to Docker Hub to allow the use of mirror.gcr.io.

Test run of the action: https://github.com/nikpivkin/trivy-checks/actions/runs/11852006001/job/33029492752
Image: https://hub.docker.com/repository/docker/nikpivkin/trivy-checks/general

The action requires the DOCKERHUB_USER and DOCKERHUB_TOKEN secrets and create a trivy-checks repository on Docker Hub.

The variables GHCR_USER and DOCKERHUB_REPOSITORY are added to run an action in the fork. The defaults are aqua-bot and aquasec respectively.

Use of a mirror:

trivy conf main.tf -d --cache-dir cache --checks-bundle-repository mirror.gcr.io/nikpivkin/trivy-checks:latest
2024-11-15T13:35:32+06:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-11-15T13:35:32+06:00       DEBUG   Cache dir       dir="cache"
2024-11-15T13:35:32+06:00       DEBUG   Cache dir       dir="cache"
2024-11-15T13:35:32+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-11-15T13:35:32+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2024-11-15T13:35:32+06:00       DEBUG   [misconfig] Failed to open the check metadata   err="open cache/policy/metadata.json: no such file or directory"
2024-11-15T13:35:32+06:00       INFO    [misconfig] Need to update the built-in checks
2024-11-15T13:35:32+06:00       INFO    [misconfig] Downloading the built-in checks...
2024-11-15T13:35:32+06:00       DEBUG   [misconfig] Loading check bundle        repository="mirror.gcr.io/nikpivkin/trivy-checks:latest"
2024-11-15T13:35:32+06:00       DEBUG   Credential error        err="docker-credential-gcr/helper: could not retrieve GCR's access token: google: could not find default credentials. See https://cloud.google.com/docs/authentication/external/set-up-adc for more information"
160.67 KiB / 160.67 KiB [--------------------------------------------------------------------------------------------] 100.00% 2.14 MiB p/s 300ms
2024-11-15T13:35:35+06:00       DEBUG   [misconfig] Digest of the built-in checks       digest="sha256:9a83fb3b2d9f154ba73717059e0f4e188e05c39d773abb2e2934e61abbbad6df"
2024-11-15T13:35:35+06:00       DEBUG   [misconfig] Checks successfully loaded from disk

[nikpivkin]

@simar7 Despite the message Credential error the bundle downloaded successfully. Maybe we don't need to try to use the credentials for the mirror.