UID2-7877: Use shared manifest for sample image workflows

[swibi-ttd]

Summary

Alternative implementation to #216. This PR centralizes the sample image definitions so publishing and vulnerability scanning use the same source of truth.

• add .github/sample-images.json with all 14 deployed sample images
• generate the release workflow matrix from that manifest
• build and scan every image from the same manifest
• retain the repository filesystem scan
• aggregate scan results into a single Slack notification when any scan fails

Do not merge this together with #216; this PR is intended for comparison.

Context

• Jira: UID2-7877
• Example missed failure: GitHub Actions run 35184808998

Validation

• actionlint passes for both modified workflows
• jq validates all 14 manifest entries contain the required fields
• manifest mappings exactly match the existing release workflow mappings
• git diff --check passes

No release workflow was dispatched, because it publishes images and updates the snapshot version.