Update trivy scanning job

[yunchu]

Summary

This PR change the behavior of Trivy scanning job in code-scan workflow.

• MEDIUM, HIGH, and CRITICAL vulnerability issues from the trivy scanning report will be treated as an error.
• added spdx.json format dependency list reporting steps

How to test

Checklist

• I have added unit tests to cover my changes.​
• I have added integration tests to cover my changes.​
• I have ran e2e tests and there is no issues.
• I have added the description of my changes into CHANGELOG in my target branch (e.g., CHANGELOG in develop).​
• I have updated the documentation in my target branch accordingly (e.g., documentation in develop).
• I have linked related issues.

License

• I submit my code changes under the same Apache License that covers the project.
  Feel free to contact the maintainers if that's a concern.
• I have updated the license header for each file (see an example below).

# Copyright (C) 2024 Intel Corporation
# SPDX-License-Identifier: Apache-2.0