fix(ci): optimize analysis jobs

[DerekRoberts]

Summary

This PR consolidates the repository's test and security scanning logic into a single reusable-analysis.yml workflow, eliminating redundancies and ensuring exact testing parity across all GitHub events.

Architectural Changes:

1. Unified Analysis Workflow: Migrated backend-tests, frontend-tests, and trivy scanning into .github/workflows/reusable-analysis.yml.
2. Removed Trigger Racing: Deleted the standalone analysis.yml file. PRs will now only trigger pr-open.yml (which calls the reusable workflow).
3. Consolidated PR Gate: Updated the results check in pr-open.yml to wait for both deployment jobs and the new analysis workflow call.
4. Trivy Optimizations: Includes path triggers (diff-triggers), dynamic caching (hashFiles), and strict exit code gating (exit-code: 1) for secrets and misconfigurations.

⚠️ WARNING TO MAINTAINERS: Before merging this, you MUST update the Branch Protection Rules for main to require PR Results instead of Analysis Results.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

This PR updates the GitHub Actions Trivy security scan job to reduce unnecessary runs and tighten enforcement by gating secrets/misconfiguration findings while still publishing vulnerability results to the Security tab.

Changes:

• Adds bcgov/actions/diff-triggers path-based filtering to skip Trivy on non-impacting changes.
• Updates the Trivy DB cache key to be derived from hashFiles('.github/workflows/analysis.yml') instead of a hardcoded version string.
• Splits Trivy scanning so secrets/misconfig failures gate the workflow (exit-code: 1) while vulnerability reporting remains non-blocking (exit-code: 0) and still uploads SARIF.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.