Chore: [AEA-6424] - use new common workflows

[anthony-nhs]

Summary

• Routine Change

Details

• move to latest qc
• remove all trivy files
• add CODEOWNERS to restrict updates to workflows
• use least permissions on all workflows
• add --ignore-scripts true to npm install

[Copilot]

Pull request overview

Updates this repo to align with the latest eps-common-workflows and hardens workflow/repo guardrails (least-privilege permissions, ownership restrictions), while replacing Trivy ignore configuration with Grype/Zizmor configuration.

Changes:

• Bump reusable workflow references to the latest NHSDigital/eps-common-workflows and add explicit least-privilege permissions blocks across workflows.
• Add Grype/Zizmor configuration and wire a Grype scan into pre-commit; ignore generated SBOM output.
• Add CODEOWNERS protection for workflow updates and remove legacy Trivy ignore + deprecated composite actions.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
zizmor.yml	Adds Zizmor rule ignores for known findings in workflows.
.trivyignore.yaml	Removes Trivy ignore list (risk: Trivy config still present elsewhere).
.pre-commit-config.yaml	Adds a local pre-commit hook to run a Grype scan.
.grype.yaml	Adds Grype ignore configuration for a specific GHSA.
.gitignore	Ignores .sbom/ output directory.
.github/workflows/run_release_code_and_api.yml	Adds workflow-level permissions lockdown and various hardening tweaks (checkout credential persistence, env usage).
.github/workflows/run_regression_tests.yml	Adds workflow-level permissions lockdown and checkout hardening.
.github/workflows/run_package_code_and_api.yml	Adds workflow-level permissions lockdown and checkout hardening.
.github/workflows/release.yml	Updates common workflow pins and adds explicit job permissions.
.github/workflows/pull_request.yml	Updates common workflow pins and adds explicit job permissions.
.github/workflows/delete_old_cloudformation_stacks.yml	Adds workflow-level permissions lockdown and checkout hardening.
.github/workflows/ci.yml	Updates common workflow pins and adds explicit job permissions.
.github/CODEOWNERS	Restricts approvals for workflow changes to @NHSDigital/eps-admins.
.github/actions/update_confluence_jira/action.yml	Removes unused composite action.
.github/actions/mark_jira_released/action.yml	Removes unused composite action.
.devcontainer/devcontainer.json	Bumps devcontainer image version.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud