fix: upgrade trivy-action to v0.36.0 (v0.29.0 had broken setup-trivy dep)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AhwicpfSvKesuRxBHs9sQ2

Author: claude

.github/workflows/ci.yaml

@@ -223,7 +223,7 @@ jobs:
           path: sbom.spdx.json
 
       - name: Vulnerability scan
-        uses: aquasecurity/trivy-action@v0.29.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: fs
           scan-ref: .