Fix pipeline scan job

[JunAr7112]

Description

This PR is created in response to the following breaking pipeline changes:

1. Pulse Scanners — Removal of --ssa $SSA_TOKEN Flag: Remove --ssa $SSA_TOKEN from any direct CLI invocations. The token is fetched from the environment variable SSA_TOKEN.

This change will use the cli invocation to fix this:
pulse-cli -n "${NSPECT_ID}" scan-image -i "${CONTAINER_IMAGE}" --platform "${PLATFORM}" -p "${CONTAINER_POLICY}" --output-dir="scan-results" -o

2. Pulse Container Scanner — Docker / DIND capabilities removed: Migrate to registry based scanning which is daemonless. If your job requires Docker CLI commands independent of scanning, add those explicitly to your job definition. Docker login has been replaced with a config.json-based approach. The scanner container now runs as a non-root user. Config is written to $HOME/.docker/config.json (was hardcoded /root/.docker/). File permissions are locked down (chmod 700 ~/.docker, chmod 600 config.json). REGISTRY_AUTH_FILE is exported for skopeo compatibility

This change will replace docker login + docker pull + docker save with registry-based scanning via a $HOME/.docker/config.json and an exported REGISTRY_AUTH_FILE, and disables the inherited docker:dind sidecar with services: []

Checklist

• [ x] No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths

Testing

Tested on Gitlab. Verified pipeline scan job is running now.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[rajatchopra]

/lgtm