Security scanning CI on GitHub Actions

Vulnerability scanners re-download their databases on every run.

Why it happens

Trivy, Grype and similar tools fetch a multi-hundred-megabyte database each time.

What to change

1. Cache the vulnerability database directory keyed on the day
2. Run scans in parallel with tests rather than after them
3. Fail only on the severities you will actually act on

Security scanning on runnerhut

jobs:
  scan:
    runs-on: runnerhut-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: ~/.cache/trivy
          key: trivy-${{ github.run_id }}
          restore-keys: trivy-
      - run: trivy fs --severity HIGH,CRITICAL .

The only runnerhut-specific line is `runs-on: runnerhut-4vcpu-ubuntu-2404`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.