Add a step in CI for CVEs scanning

[francbartoli]

Overview

This PR closes #1477. It uses trivy and has the following limitations:

• It doesn't take into account Docker image vulnerabilities, a dedicated PR will come up for that specific purpose
• It only checks for HIGH and CRITICAL vulnerabilities
• It accepts the risk for now that the Dockerfile uses the ROOT user, this misconfiguration is ignored in the .trivyignorefile

Related issue / discussion

#1477

Additional information

Trivy is an easy-to-use, fast, and comprehensive open-source tool used by DevOps and security teams for vulnerability and infrastructure as code (IaC) scanning of containers and artifacts.  Trivy is open-source and maintained by Aquasecurity, :

• Works with containers, file systems, or even git repositories.
• Is easy to install with no prerequisites, such as the installation of a database.
• Is fast to run because there is no database involved.
• Fits the DevSecOps methodology as it can be integrated into CI systems (Circle CI, Jenkins, GitLab CI, or GitHub Actions).
  
  (Ref. https://bluelight.co/blog/how-to-set-up-trivy-scanner-in-gitlab-ci-guide)

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution
• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines

[tomkralidis]

Minor changes. In addition, we can then add the following to README.md:

[![Vulnerabilities](https://github.com/geopython/pygeoapi/actions/workflows/vulnerabilities.yml/badge.svg)](https://github.com/geopython/pygeoapi/actions/workflows/vulnerabilities.yml)