Use the upstream Trivy action to scan licenses

[cbandy]

The upstream action no longer runs in a container, so it can access the job environment and Go modules. The license job no longer needs any ghcr.io package, so it is no longer affected by the recent rate limiting issues.

Checklist:

• Have you added an explanation of what your changes do and why you'd like them to be included?
• Have you updated or added documentation for the change, as applicable?
• Have you tested your changes on all related environments with successful results, as applicable?
  • Have you added automated tests?

Type of Changes:

• Testing enhancement

[benjaminjb]

LGTM. (Though ❓ : you prefer pinning to master rather than the 0.26.0 tag?)

What do you think about their current suggestion re: caching the vuln db in a default branch daily and using that cached db in other branches?

[cbandy]

LGTM. (Though ❓ : you prefer pinning to master rather than the 0.26.0 tag?)

👍🏻 I'll bump these actions to the tag. Dependabot should keep us informed/updated now.

What do you think about their current suggestion re: caching the vuln db in a default branch daily and using that cached db in other branches?

I'm going to stop worrying about this in GitHub. They know the problem now, so I'm OK waiting for them to make the necessary changes to their action.