Post the per-image Grype scan table to Slack on PR and weekly runs

[jsokol]

Description

Follow-up to #174. A clean run posted nothing to Slack, so there was no way to tell a clean run from a run that never happened. PR validation and the weekly scan now always post the per-image table.

• New always_post input on the grype-report action (default false). When true, the Slack message includes one status line per scanned image: ✅ No findings, ⚠️ N findings (by severity), or ❌ scan did not complete. With findings, the table appears above the vulnerability list.
• Enabled for container-validation.yml (PR runs) and scheduled-grype-scan.yml (weekly). The publish-time report keeps the findings-only behaviour.
• grype-scan-summary.sh gains a SUMMARY_FORMAT=slack mode; grype-slack-digest.sh accepts an optional SUMMARY and emits a payload even with no findings when it is set. Without SUMMARY it still emits nothing on a clean run.
• Fixed the digest script's empty-report-directory case under set -u, so a run where no scan produced a report still posts the all-❌ table instead of failing.

Release Notes

N/A (CI only).

Testing

• Ran the digest script against sample report sets for: all clean, mixed clean/did-not-complete, findings plus summary, no summary + clean (emits nothing), and no reports + summary (all ❌). Output checked with jq.
• ShellCheck and actionlint clean (aside from the existing create_new_tag.yml note); YAML parses.
• Not tested until it runs on GitHub: the composite action's new Slack step. This PR's own validation run posts to the channel, so that run is the check.

Notes for reviewers

Every PR run will now post one message to the channel, including from later pushes to the same PR. Fork PRs skip the post (no secret).