Cache trivy

[jimmykarily]

Fixes #2904

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[jimmykarily]

I don't understand at which point the cache is saved. Looking at this pipeline: https://github.com/yogeshlonkar/trivy-cache-action/blob/5e3c2d406dd3a13d95a3eabc520e0ac19ab729b5/.github/workflows/workflow.yml#L48
I think we may need to run it before our step to restore it and after it to save it. But I'm trying to verify that it works like that in code.

[jimmykarily]

I don't understand at which point the cache is saved. Looking at this pipeline: https://github.com/yogeshlonkar/trivy-cache-action/blob/5e3c2d406dd3a13d95a3eabc520e0ac19ab729b5/.github/workflows/workflow.yml#L48 I think we may need to run it before our step to restore it and after it to save it. But I'm trying to verify that it works like that in code.

Found it.

So this solution works like this:

At the beginning of the pipeline and before any workflows request the trivy database:

• We run the yogeshlonkar/trivy-cache-action@v0 action first to populate the .trivy directory from the GitHub cache. The cache key includes the db hash and the branch name so it's valid for the same branch for as long as the db is fresh
• We run the new earthly target trivy-download-db to populate the .trivy directory (either because no cache was found in the previous step or because there is a fresh db to be downloaded)
• The action has a "post" step which pushes the contents of the possibly updated .trivy directory back to GitHub cache.

After this is done, we are sure we have populated the GitHub cache with the latest db. From there on, any workflow that needs the trivy cache, will run the trivy-cache-action to populate the .trivy dir and pass it to the earthly targets using the new TRIVY_CACHE_DIR argument.