Vulnerability scanning

I'd like to add some security / vulnerability scanning into the CI pipeline. As far as I know there's no obvious choice for this. I've used [dependencyCheck](https://github.com/jeremylong/DependencyCheck#900-upgrade-notice), but it's slow, reporting isn't great and frequently has false-positives. I've used [trivy](https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#using-trivy-to-scan-your-git-repo) which is a bit faster and never has false positives, but scans the dependency jars, rather than the gradle files, so it needs a bit of set up to put the jars in place to be scanned. There's also [github scanning](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning), which I've not used, and I'm sure there are many others. Any of these options will also consume github action minutes, I'm not sure whether that's a concern or not. Any thoughts @kdubb @davecramer?