Security update for trivy

Open Source Vulnerabilities openSUSE-SU-2026:21072-1

This update for trivy fixes the following issues Update to version 0.71.2: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268). - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268356). - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268440). - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's configuration (bsc#1268399). - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation (bsc#1268400). - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked path (bsc#1268404). - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration (bsc#1268403). Changes for trivy: * release: v0.71.2 [release/v0.71] (#10871) * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870) * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867) * fix(oci): validate artifact filename * fix: forward ospkg detector options through ospkg.NewScanner * fix(vex): load VEX documents from within the repository directory * fix: surface the original analysis error instead of context cancellation * ci: expect GitHub App bot as backport PR author