adding high/critical severity vuln checks

[ssmirr]

This Pull request updates the Dockerfile to check dependencies of this source code, and fail to build if high/critical severity vulnerabilities are detected.

Currently this one is detected:

8.938 go.mod (gomod)
8.938 ==============
8.938 Total: 1 (UNKNOWN: 0, HIGH: 1, CRITICAL: 0)
8.938 
8.938 ┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬────────────────────────┬───────────────────────────────────────────────────┐
8.938 │        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │     Fixed Version      │                       Title                       │
8.938 ├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼────────────────────────┼───────────────────────────────────────────────────┤
8.938 │ google.golang.org/grpc │ GHSA-m425-mq94-257g │ HIGH     │ fixed  │ 1.29.0            │ 1.56.3, 1.57.1, 1.58.3 │ gRPC-Go HTTP/2 Rapid Reset vulnerability          │
8.938 │                        │                     │          │        │                   │                        │ https://github.com/advisories/GHSA-m425-mq94-257g │
8.938 └────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴────────────────────────┴───────────────────────────────────────────────────┘
------

This is done with the help of Trivy, an open source scanning tool from Aquasec. Trivy is RedHat certified, and is being used as the default container scanner on GitLab (according to this link)

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 68.78%. Comparing base (7300295) to head (e57946a).
Report is 3 commits behind head on main.

❗ Current head e57946a differs from pull request most recent head 727fa66. Consider uploading reports for the commit 727fa66 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #123      +/-   ##
==========================================
+ Coverage   68.71%   68.78%   +0.06%     
==========================================
  Files          47       47              
  Lines        4482     4482              
==========================================
+ Hits         3080     3083       +3     
+ Misses       1207     1206       -1     
+ Partials      195      193       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[nguyer]

@jimthematrix Do you mind taking a look at this one? Our vulnerability tool does not like this version, but it looks like we were very intentionally staying on this version for some reason. Do you know why this was here?

[jimthematrix]

pretty sure this is why: https://github.com/hyperledger/fabric-sdk-go/blob/main/go.mod#L30. But I can't remember what the exact error was if we used a later version.

[jimthematrix]

is there a way to override the failure in the vulnerability tool? This problem is only relevant when using grpc to implement server endpoints. in the case of FabConnect, grpc is only between it and the Fabric endpoint, so the attack vector is not exposed via FabConnect

[peterbroadhurst]

marking approval on PR based on agreement with this assessment from @jimthematrix

[nguyer]

Strange... make passes just fine locally

[ssmirr]

Changes in 7de4ef4 make trivy ignore this specific CVE, as requested in #123 (comment)