chore: add trivy:ignore comments for builder stage findings

Author: david-waltermire

Dockerfile.ci

@@ -1,8 +1,12 @@
 # syntax=docker/dockerfile:1
+# trivy:ignore:DS026 - CLI tool runs and exits, HEALTHCHECK not applicable
 ARG BUILDER_IMAGE=maven:3.9.9-eclipse-temurin-17
 ARG RUNNER_IMAGE=eclipse-temurin:17
 
+# Builder stage runs as root; runner stage uses non-root user
+# trivy:ignore:DS029
 FROM ${BUILDER_IMAGE} AS builder
+# trivy:ignore:DS029
 RUN apt-get update && apt-get install -y unzip
 COPY ./target/*oscal-cli.zip /tmp/oscal-cli.zip
 WORKDIR /tmp

Dockerfile.local

@@ -1,13 +1,18 @@
 # syntax=docker/dockerfile:1
+# trivy:ignore:DS026 - CLI tool runs and exits, HEALTHCHECK not applicable
 ARG BUILDER_IMAGE=maven:3.9.9-eclipse-temurin-17
 ARG RUNNER_IMAGE=eclipse-temurin:17
 
+# Builder stage runs as root; runner stage uses non-root user
+# trivy:ignore:DS029
 FROM ${BUILDER_IMAGE} AS builder
 ARG BUILDER_JDK_VENDOR=temurin
 ARG BUILDER_JDK_MAJOR_VERSION=17
 ARG BUILDER_JDK_HOME_PATH=/opt/java/openjdk
+# trivy:ignore:DS005 - ADD used intentionally to copy entire build context
 ADD . /usr/local/src
 WORKDIR /usr/local/src
+# trivy:ignore:DS029
 RUN apt-get update && apt-get install -y unzip
 RUN <<EOF
 mkdir -p /root/.m2