refactor: scan images directly with trivy, output per-image CVE JSON

Skip SBOM generation entirely since cve-edge-post.yml only needs
vulnerability counts, not CycloneDX artifacts — scan each image with
`trivy image` directly and aggregate with python3 (drop jq dependency).
Output is now a JSON array with one entry per image instead of a single
merged summary.

doc/scripts/Dockerfile

@@ -5,7 +5,7 @@
 #   로 사용되는 이미지. doc/scripts/*.sh 를 컨테이너 내부에서 직접 실행한다.
 #   상세: doc/sbom-pipeline.md
 #
-# 도구: helm(v3) + trivy + python3 + bash + git + jq
+# 도구: helm(v3) + trivy + python3 + bash + git
 # 베이스: debian(glibc) — GitHub Actions container 안에서 node 기반 액션
 #         (actions/checkout, upload-artifact)이 동작하려면 glibc 필요.
 #         (alpine/musl 은 node 실행 실패 가능 → debian 사용)
@@ -18,7 +18,7 @@
 FROM debian:stable-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      curl ca-certificates git python3 bash jq \
+      curl ca-certificates git python3 bash \
  && rm -rf /var/lib/apt/lists/*
 
 # helm v3