Add support for multiple vulnerability database repositories

[benji78]

At the time of my previous pull request (#3), this scanner adapter only supported trivy v0.54.1. In trivy v0.56.0 support for multiple vulnerability database repositories was added.

Here is how it can be used:

    trivy:
      extraEnvVars:
        - name: SCANNER_TRIVY_DB_REPOSITORY
          value: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
        - name: SCANNER_TRIVY_JAVA_DB_REPOSITORY
          value: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db

I also added these to the config test and updated the wrapper test.

This also includes the same README fix as #6, updates the default repositories and adds some info to values.yaml.

I am just waiting for trivy to update the default registries to mark this PR as ready.

[benji78]

Should I hardcode the default repositories? I was thinking using trivy's default might be better but if they change in future the README documentations would be wrong

[stgdns]

two days ago a new trivy version has been released: v0.57.1
The default URLs have changed:
aquasecurity/trivy#7679

[benji78]

This is indeed what I am referring to and the reason why I waited before creating this PR (and had it as a draft) because I needed to update the documentation.

[reasonerjt]

I intend to bump up the adapter to v0.32.1 consuming trivy v0.57.1

IMO this change is probably not needed for v0.32.1, thoughts? @benji78

[reasonerjt]

It can remain as a string and we just document the value should be comma separated URIs?

[benji78]

I could do that, but even though we are not changing or using the URIs separately right now, I believe it is clearer and more future proof to use an array of strings.
We could, for example, strip any spaces around the comma (may not be such a good practice though) or change from comma separated string to using one --db-repository or --java-db-repository per URI.

[benji78]

Trivy v0.56.0 (and therefore also harbor-scanner-trivy v0.32.0) already supports multiple repositories, so bumping to trivy v0.57.1 will just update the database registry fallback (and other unrelated changes).