Add support for --db-repository and --java-db-repository

[benji78]

This implements the --db-repository and --java-db-repository options to allow users to specify a custom Trivy vulnerability DB repository. This is useful for users who want to use a custom database repository, such as a private repository mirror like Artifactory or other private registries.

This adds SCANNER_TRIVY_DB_REPOSITORY and SCANNER_TRIVY_JAVA_DB_REPOSITORY environment variables as well as scanner.trivy.dbRepository and scanner.trivy.javaDBRepository helm values.

I have updated the documentation to reflect this new option, as well as one of the existing wrapper tests (feel free to change it).

This is the first step to address the issue I created on the harbor-helm repository: goharbor/harbor-helm#1821

[reasonerjt]

lgtm

[pkalemba]

i know that is a merged PR but , maybe we missed something, what if user want to use a private registry eg. local harbor.
You need provide somehow auth details....

@benji78

[benji78]

If we want to add authentication, it is much more complicated than just adding a --dbRepository option in the command being ran. I don't think using trivy registry login (previously trivy auth login) is possible. Therefore, it would require adding --username and --password (which is not recommended as the password may be exposed) or TRIVY_PASSWORD environment variable if it even is possible.
Also we would need to make sure it is working with multiple DB repositories likely coming in the next trivy release (v0.58).

[hoerup]

multi DB repo was enabled in 0.56

aquasecurity/trivy#7640

📦 Support for multiple DB repositories for vulnerability and Java DB ↻

[benji78]

@pkalemba I was working on multi DB repository when, looking at the tests, I realised that it should already work with:

    trivy:
      extraEnvVars:
        - name: TRIVY_USERNAME
          value: USERNAME1,USERNAME2
        - name: TRIVY_PASSWORD
          value: PASSWORD1,PASSWORD2