Add scheduled Snyk check for Docker image

[keyvaann]

This PR adds a weekly scan by Snyk to check the Docker image and will suggest fixes if it fails.

[mpgxvii]

@keyvaann I think the main test workflow is failing because of the deprecated action upload-artifact. We can just update to v4 and the tests will run again. I've updated here: 6c775c6

[mpgxvii]

LGTM! Just minor comment.

[keyvaann]

Thanks @mpgxvii, I applied the fix.

[mpgxvii]

Thanks! Also, are we merging to master directly?

[keyvaann]

@mpgxvii I don't know where is the best place to merge it. Maybe @pvannierop has suggestions?

[pvannierop]

@mpgxvii @keyvaann

Thanks! Also, are we merging to master directly?

Depends on the state of the dev branch. We need to make a periodic release that fixes vulnerabilities. I rather not have to deal with problems that arise from features that are in development. I, therefore, would like a PR directly to master.

[pvannierop]

I have two issues that I would like to raise:

• Should the scheduled action only trigger on master branch?
• Should the scheduled docker action replace the current Snyk scan that is performed for each commit to a PR branch?

[keyvaann]

I have two issues that I would like to raise:

• Should the scheduled action only trigger on master branch?
• Should the scheduled docker action replace the current Snyk scan that is performed for each commit to a PR branch?

It's probably better to run it only on master branch since this is used to fix security vulnerabilities.
I think having a snyk scan that directly checks the codebase is better than the docker image scan so I think the current snyk scan in each commit is good, but I don't know how much attention is actually being paid to it.