[FEATURE] Add Trivy CI snippet

[prog-time]

Summary

Adds a Trivy CI snippet to the security category — a universal vulnerability scanner covering filesystem, container images, and language-specific dependency manifests (npm, pip, go.mod, Gemfile.lock, composer.lock, Cargo.lock). Follows the three-layer pattern (shell script → source YAML → assembled YAML) established by gitleaks, with actions/cache@v4 for ~/.cache/trivy to avoid redundant DB downloads.

Changes

• issues-8|add trivy CI snippet — scripts/shell/security/trivy.sh, scripts/CI/security/trivy.yml, CI/security/trivy.yml
• issues-8|add BATS tests for trivy — 4 tests (missing binary, clean scan, vulnerable scan, info message)
• issues-8|document trivy in README — Snippets table, Security section, project structure tree

Test plan

• bats tests/security/trivy.bats — 4/4 pass
• yamllint clean on both new YAML files
• CI green on this PR

Closes #8