Add Trivy dependency scan to CI

Author: beepboopworld

README.md

@@ -14,8 +14,9 @@ A minimal REST API written in Go to demonstrate secure development practices and
 - Use logging cautiously to prevent data leaks.
 - CI integration makes security part of the developer workflow.
 - Security scan (gosec) initially flagged missing error handling and server timeouts, which were remediated. Current scan reports zero issues. 
+- Added Trivy dependency scanning alongside static analysis to simulate supply-chain and SCA checks in CI.
 
 ## Next Steps
 - Add JMT auth example.
-- Integrate Vault for secret injection
+- Integrate Vault for secret injection.
 - Add Dockerfile and container scan.