Add Trivy Scanning to build/publish pipeline

[joelmccoy]

Trivy has the ability to scan AMIs. We should introduce it in this pipeline in order vulnerability reporting/feedback on the AMIs we build. This can probably be introduced in a non-blocking mode to just provide insight into current vulns, and then based on that data we can determine if we want to fail CI based on results of the scans.