bug(k8s): inconsistent results for scan with and without images

[afdesk]

Description

Misconfiguration and Image scans in kubernetes were splitted in #7690, and it brought a nasty bug.

Early the both scans worked in the same function, and misconfigs and vulns from images handled as the same item.
now there are two separated processes. Trivy gets misconfigurations and then appends image vulns.

if Trivy can't receive images (ex there are no permissions), there will be added an empty result and existed misconfig report will be skipped in the report.

Note: some kind of this bug was before #7690, but It didn't matter for most cases, because image vulns were adding before misconfigurations.

Reason

it affects only on summary report.
If a resource has no vulns or secret findings and has misconfigs, index item will be overridden by the latest result:

trivy/pkg/k8s/report/report.go

Lines 90 to 96 in c0d79fa

	for _, m := range r.Resources {
	if vulnerabilitiesOrSecretResource(m) {
	vulnerabilities = append(vulnerabilities, m)
	} else {
	index[m.fullname()] = m
	}
	}

Reproduction

I can reproduce this bug in my demo managment k8s cluster.

Scan with --skip-images:

Infra Assessment
┌─────────────┬──────────────────────────────────────────────┬───────────────────┬──────────────────────┬───────────────────┐
│  Namespace  │                   Resource                   │  Vulnerabilities  │  Misconfigurations   │      Secrets      │
│             │                                              ├───┬───┬───┬───┬───┼───┬────┬────┬────┬───┼───┬───┬───┬───┬───┤
│             │                                              │ C │ H │ M │ L │ U │ C │ H  │ M  │ L  │ U │ C │ H │ M │ L │ U │
├─────────────┼──────────────────────────────────────────────┼───┼───┼───┼───┼───┼───┼────┼────┼────┼───┼───┼───┼───┼───┼───┤
│ kube-system │ Service/kube-dns                             │   │   │   │   │   │   │    │ 1  │    │   │   │   │   │   │   │
│ kube-system │ DaemonSet/cilium                             │   │   │   │   │   │   │ 19 │ 28 │ 57 │   │   │   │   │   │   │
│ kube-system │ DaemonSet/kube-proxy                         │   │   │   │   │   │   │ 3  │ 5  │ 9  │   │   │   │   │   │   │
│ kube-system │ Service/hubble-peer                          │   │   │   │   │   │   │    │ 1  │    │   │   │   │   │   │   │
│ kube-system │ Deployment/cilium-operator                   │   │   │   │   │   │   │ 2  │ 4  │ 9  │   │   │   │   │   │   │
│ kube-system │ ConfigMap/cilium-config                      │   │   │   │   │   │   │    │ 1  │    │   │   │   │   │   │   │
│ kube-system │ ConfigMap/extension-apiserver-authentication │   │   │   │   │   │   │    │ 1  │    │   │   │   │   │   │   │
│ kube-system │ Deployment/coredns                           │   │   │   │   │   │   │ 1  │ 4  │ 4  │   │   │   │   │   │   │
└─────────────┴──────────────────────────────────────────────┴───┴───┴───┴───┴───┴───┴────┴────┴────┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

Scan with unreachable images (without --skip-images):

Infra Assessment
┌─────────────┬──────────────────────────────────────────────┬───────────────────┬───────────────────┬───────────────────┐
│  Namespace  │                   Resource                   │  Vulnerabilities  │ Misconfigurations │      Secrets      │
│             │                                              ├───┬───┬───┬───┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│             │                                              │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
├─────────────┼──────────────────────────────────────────────┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┤
│ kube-system │ ConfigMap/cilium-config                      │   │   │   │   │   │   │   │ 1 │   │   │   │   │   │   │   │
│ kube-system │ Service/hubble-peer                          │   │   │   │   │   │   │   │ 1 │   │   │   │   │   │   │   │
│ kube-system │ ConfigMap/extension-apiserver-authentication │   │   │   │   │   │   │   │ 1 │   │   │   │   │   │   │   │
│ kube-system │ Service/kube-dns                             │   │   │   │   │   │   │   │ 1 │   │   │   │   │   │   │   │
└─────────────┴──────────────────────────────────────────────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN