ci(security): pin trivy-action to an existing tag (v0.30.0) so the gate can resolve on Gitea Actions

The first real platform runs (2026-08-17, new instance runner) failed at
'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0.
Where present, the trufflehog GitHub Action (which fails under the act runner) is
replaced by the pinned trufflehog binary in filesystem mode next to gitleaks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           path: ./
           extra_args: --only-verified
       - name: Scan project dependencies and lockfiles (high/critical)
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.30.0
         with:
           scan-type: fs
           scan-ref: .
@@ -66,7 +66,7 @@ jobs:
       - name: Build production image
         run: docker build --pull --tag vacatureradar:ci .
       - name: Scan container image for high/critical vulnerabilities
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.30.0
         with:
           image-ref: vacatureradar:ci
           format: table
@@ -74,7 +74,7 @@ jobs:
           exit-code: "1"
           ignore-unfixed: true
       - name: Generate CycloneDX software bill of materials
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.30.0
         with:
           image-ref: vacatureradar:ci
           format: cyclonedx