Build: add security-policy and vulnerability-reporting annotations

[toddysm]

Summary

Add image annotations to the CSSC Dashboard images that expose the project's security policy and a programmatic vulnerability-reporting URL, so consumers can discover both from image metadata.

Motivation

The images already carry rich supply-chain annotations (source, revision, base image, build workflow/run, SBOM + provenance referrers). What is missing is a machine-discoverable pointer to the security policy and to where/how to report a vulnerability in these images. Surfacing these links in the annotations keeps them traveling with the image regardless of registry UI.

Proposed change

Add two separate custom annotations (there are no standard org.opencontainers.image.* annotations for these, so com.toddysm.* custom annotations are used, consistent with the existing namespace):

1. Security policy — com.toddysm.security.policy
   • Value: URL of the human-readable security policy (the repo SECURITY.md, e.g. https://github.com/toddysm/cssc-framework/security/policy).
   • This is the annotation already described previously.
2. Vulnerability reporting URL — com.toddysm.security.report-url
   • Value: the URL that can be used to programmatically report a vulnerability (the GitHub private advisory intake endpoint, e.g. https://github.com/toddysm/cssc-framework/security/advisories/new).

For both annotations:

• Set them at both the multi-arch index and each per-platform manifest, matching how the other annotations are applied.
• Wire the values through build-cssc-dashboard.yml alongside the existing --annotation flags.

Prerequisite

• A SECURITY.md security policy — being added in Create a security policy (SECURITY.md) #136 / PR Add repository security policy (SECURITY.md) #137. Once merged, the policy is served at .../security/policy and the reporting intake at .../security/advisories/new.

Docs to update

The documentation must be updated to describe both new annotations:

• docs/reference/image-annotations.md — add both annotations to the Custom annotations (com.toddysm.*) table.
• docs/guides/build/reading-image-annotations.md — show how to read the security-policy and vulnerability-reporting links.

Acceptance criteria

• All three service images publish both the com.toddysm.security.policy and com.toddysm.security.report-url annotations at index + per-platform manifest.
• com.toddysm.security.policy resolves to the security policy page.
• com.toddysm.security.report-url resolves to the programmatic vulnerability-reporting endpoint.
• Reference + guide docs updated to document both new annotations.