Scope vulnerability data to live images and add manual rescan

[LarsLaskowski]

Pull Request

📖 Description

The dashboard previously counted active vulnerability findings for every image version that had ever been scanned, including image versions no longer backing any running container. Digging into the scan pipeline showed the same gap one level deeper: the batch vulnerability scan kept rescanning (and thus kept alive) any image version with so much as a historical container snapshot, so retired image versions and their findings never aged out of the database.

This PR:

• Aligns the batch vulnerability scan's eligibility with the same "live" definition already used elsewhere (observed images' current version, currently running containers, and their base-image dependencies), so retired image versions stop being rescanned and their findings get deactivated on the next cycle.
• Extends the cleanup job to purge deactivated findings of non-live image versions immediately, while keeping the existing 30-day retention for findings resolved on still-live images (e.g. a genuinely patched CVE).
• Adds a "last vulnerability scan" timestamp to the Runtime Containers, Observed Images, and My Images tables.
• Adds a per-row manual rescan trigger (per running container or per image) via a new reusable VulnerabilityRescanControl component and a new IVulnerabilityEnrichmentService.RefreshImageVersionAsync method that rescans a single image version without touching findings elsewhere in the fleet.

🎫 Issues

N/A

👩‍💻 Reviewer Notes

• VulnerabilityEnrichmentService.RefreshAsync and ScanCleanupBackgroundService.ExecuteCoreAsync are the core behavior changes; the rest is UI plumbing (new DTO fields, a new shared component, wiring into three pages).
• Three existing tests in VulnerabilityEnrichmentServiceTests.cs relied on a retired image version staying scan-eligible solely because of a stale container snapshot; they were updated to use setups that stay legitimately live, and one was repurposed into a direct regression test for the eligibility fix.
• A smoke test worth doing manually: open Runtime Containers / Observed Images / My Images, confirm the "Checked " line and rescan button render per row, and that clicking rescan updates just that row.

📑 Test Plan

Added/updated unit and component tests covering: the scan-eligibility fix and its regression case, the new single-image rescan method, the cleanup job's immediate purge for non-live image versions vs. the retained 30-day window for still-live ones, the new DTO fields on the runtime-container and observed-image projections, and the new VulnerabilityRescanControl component (success, failure, and never-scanned states).

✅ Checklist

General

• I have added tests for my changes.
• I have tested my changes.
• I have updated the project documentation to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.

UI-specific

• I have added a new Blazor page/component.
• I have added Unit Tests for the new page/component.
• I have modified an existing Blazor page/component.
• I have updated the Unit Tests for the modified page/component.

⏭ Next Steps

• The /vulnerabilities fleet-wide overview page intentionally remains unscoped (shows all active findings, including ones not currently backing a running container); worth revisiting if the dashboard's narrower scope should extend there too.
• SharedBaseImages was left read-only; the same VulnerabilityRescanControl could be added there later if a manual rescan trigger is wanted for base images as well.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud