CVE Monitor: fixable vulnerabilities in ci-tools

[github-actions]

CVE Monitor Alert

The scheduled Trivy scan found fixable CRITICAL or HIGH vulnerabilities
in the published image ghcr.io/knight-owl-dev/ci-tools:latest.

Next Steps

1. Review the workflow run that triggered this alert
2. Build and scan the image locally to investigate findings
3. Update the base image or affected packages in images/ci-tools/Dockerfile
4. Cut a new release — the publish workflow re-scans before publishing

See docs/supply-chain-security.md
for scanning policy details.