Add clair vulnerability analysis scans

[neomantra]

• Create tooling to use clair to scan our images for vulnerabilities.

• Drive using Travis.

• Run on a cron

• Improve tooling to rebuild when vulnerabilties are found

[michaelheyman]

Per your request here, I'm going to describe how to get vulnerability scans results using a different tool.

Twistlock is a security scanning tool that is now part of Prisma Cloud. It is my understanding that this is a paid tool, with unknown free support.

Here is an example of a security vulnerability report

Pulled from this issue comment

+----------------+----------+------+---------+------------------+---------------------------+-----------+------------+----------------------------------------------------+
|      CVE       | SEVERITY | CVSS | PACKAGE |     VERSION      |          STATUS           | PUBLISHED | DISCOVERED |                    DESCRIPTION                     |
+----------------+----------+------+---------+------------------+---------------------------+-----------+------------+----------------------------------------------------+
| CVE-2021-39537 | high     | 8.80 | ncurses | 6.2_p20210612-r0 | fixed in 6.3_p20211120-r0 | 73 days   | < 1 hour   | An issue was discovered in ncurses through v6.2-1. |
|                |          |      |         |                  | 73 days ago               |           |            | _nc_captoinfo in captoinfo.c has a heap-based      |
|                |          |      |         |                  |                           |           |            | buffer overflow.                                   |
+----------------+----------+------+---------+------------------+---------------------------+-----------+------------+----------------------------------------------------+
| CVE-2021-43618 | high     | 7.50 | gmp     | 6.2.1-r0         |                           | 17 days   | < 1 hour   | GNU Multiple Precision Arithmetic Library (GMP)    |
|                |          |      |         |                  |                           |           |            | through 6.2.1 has an mpz/inp_raw.c integer         |
|                |          |      |         |                  |                           |           |            | overflow and resultant buffer overflow via crafted |
|                |          |      |         |                  |                           |           |            | input, l...                                        |
+----------------+----------+------+---------+------------------+---------------------------+-----------+------------+----------------------------------------------------+

This is merely informational, and not a recommendation on security tooling.