Remediate RC6 container scan findings

scripts/scan_container_image.sh

@@ -6,6 +6,9 @@ TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
 TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
+PYTHON_CMD="${PYTHON_BIN:-python3}"
+IGNORE_FILE="$(mktemp)"
+trap 'rm -f "$IGNORE_FILE"' EXIT
 
 case "$OUTPUT" in
   /*|*..*)
@@ -16,6 +19,9 @@ esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
+  --print-container-ids > "$IGNORE_FILE"
 
 # Keep the complete report, including vulnerabilities without an available fix.
 docker run --rm \
@@ -42,6 +48,7 @@ docker run --rm \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
+  --ignorefile "$IGNORE_FILE" \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
   "$TARGET_IMAGE"