bug(misconf): unquoted merge key is not processed in YAML config files

[nikpivkin]

Description

Trivy uses gopkg.in/yaml.v3 to decode YAML that does not support << (merge) unquoted keys.

Example configuration:

...
spec:
  # when set to 0 (and only 0) will be set to 1 when the first PingSource is created.
  replicas: {{ .Values.knative.eventing.mtping.replicas }}
  selector:
    matchLabels: &labels
      eventing.knative.dev/source: ping-source-controller
      sources.knative.dev/role: adapter
  template:
    metadata:
      labels:
        !!merge <<: *labels
        eventing.knative.dev/release: "v1.9.0"
        app.kubernetes.io/component: pingsource-mt-adapter
        app.kubernetes.io/version: "1.9.0"
        app.kubernetes.io/name: knative-eventing
...

Perhaps we could use the goccy/go-yaml package, which is actively maintained and passes all the test cases from the YAML Test Suite, but I haven't looked to see if the package has the ability to get the YAML node position.

Desired Behavior

The merge key will be processed

Actual Behavior

The merge key is considered just a map key

Reproduction Steps

...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

...

Operating System

m1

Version

0.58.0

Checklist

• Run trivy clean --all
• Read the troubleshooting