[improve][ci] Replace trivy-action with sandboxed-trivy-action

[lhotari]

Motivation

The aquasecurity/trivy-action was previously commented out in the CI workflow. This PR replaces it with lhotari/sandboxed-trivy-action, which runs Trivy in a sandboxed environment for improved security.

Modifications

• Uncommented the Trivy container scan and SARIF upload steps in .github/workflows/pulsar-ci.yaml
• Replaced aquasecurity/trivy-action@v0.35.0 with lhotari/sandboxed-trivy-action@555963036b2012b44c1071508a236e569db28ebb

Verifying this change

• Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment