fix trivy: scan from registry with --image-src remote --insecure

Buildx DinD pushes images to the registry but doesn't load them
into the host Docker daemon. Trivy must pull from the registry
directly. Use --image-src remote to skip local Docker lookup and
--insecure to accept the self-signed Traefik TLS cert.

.woodpecker/deploy.yml

@@ -27,8 +27,6 @@ variables:
       from_secret: registry_pass
   - &trivy_scan
     image: aquasec/trivy:latest
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
   - &diag_env
     UV_PYTHON_PREFERENCE: only-system
     UV_LINK_MODE: copy
@@ -73,7 +71,7 @@ steps:
   - name: scan-notebooks
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o notebooks-scan.json
           "gitea.homelab.fhirworx.io/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:
@@ -94,7 +92,7 @@ steps:
   - name: scan-zotero
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o zotero-scan.json
           "gitea.homelab.fhirworx.io/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:
@@ -125,7 +123,7 @@ steps:
   - name: scan-docs
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o docs-scan.json
           "gitea.homelab.fhirworx.io/homelab/docs:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:
@@ -146,7 +144,7 @@ steps:
   - name: scan-api
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o api-scan.json
           "gitea.homelab.fhirworx.io/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:

.woodpecker/rebuild-all.yml

@@ -14,8 +14,6 @@ variables:
       from_secret: registry_pass
   - &trivy_scan
     image: aquasec/trivy:latest
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
   - &diag_env
     UV_PYTHON_PREFERENCE: only-system
     UV_LINK_MODE: copy
@@ -92,7 +90,7 @@ steps:
   - name: scan-notebooks
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o notebooks-scan.json
           "gitea.homelab.fhirworx.io/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:
@@ -101,7 +99,7 @@ steps:
   - name: scan-zotero
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o zotero-scan.json
           "gitea.homelab.fhirworx.io/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
     depends_on:
@@ -110,7 +108,7 @@ steps:
   - name: scan-api
     <<: *trivy_scan
     commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
+      - trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
           -o api-scan.json
           "gitea.homelab.fhirworx.io/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
     depends_on: