fix(ci/cve-scanning): ignore malformed packages (#1699)

Otherwise trivy fails the whole job


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- Bug Fixes
- Improved license compliance reports by filtering out malformed
packages from the software bill of materials before scanning, reducing
noise and false positives.
- Maintains existing scan flow and results formatting without changing
behavior for successful runs.

- Chores
- Updated CI processing to enhance accuracy of license scanning with no
impact on application functionality or user workflows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: cwrau

.github/scripts/scan-for-licenses.sh

@@ -72,6 +72,8 @@ function generateTrivyJson() {
   trap 'rm -f "$tmpFile"' RETURN
 
   syft "$image" -o spdx-json >"$tmpFile"
+  # ignore packages that are not fully defined, otherwise trivy fails
+  jq -r '.packages |= map(select(.name | endswith("/") | not))' "$tmpFile" | sponge "$tmpFile"
   trivy sbom "$tmpFile" --skip-{java-,}db-update --severity HIGH,CRITICAL,MEDIUM -f json --scanners license --quiet | jq -r --arg image "$image" '.Metadata.image = $image'
 }
 export -f generateTrivyJson