fix(ci): pin Trivy action to v0.36.0 (0.28.0 was a typo, never released)

CI annotations on PR #63 surfaced "Unable to resolve action
aquasecurity/trivy-action@0.28.0, unable to find version 0.28.0".
The Trivy action's release tags use a `v0.x` prefix (latest is
v0.36.0 as of 2026-04-22); my initial workflow used the
unprefixed numeric form, which doesn't exist. Aligning to the
canonical tag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: insomnius

.github/workflows/trivy.yml

@@ -52,7 +52,7 @@ jobs:
         run: docker build -t altair-trivy-scan:local -f ./Dockerfile .
 
       - name: Scan image for HIGH and CRITICAL vulnerabilities
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: altair-trivy-scan:local
           format: sarif