fix(ci): use reachable vulnerability database mirror

tests/ci/ci-build-images-test.sh

@@ -58,6 +58,8 @@ run_build() {
 run_build
 grep -Fq "docker buildx prune --builder gateway-test --force --max-used-space 2gb" "$tmp/calls.log"
 grep -Fq "docker image rm $api_image $web_image" "$tmp/calls.log"
+grep -Fq 'trivy image --db-repository ghcr.m.daocloud.io/aquasecurity/trivy-db:2' \
+  "$tmp/calls.log"
 
 : >"$tmp/calls.log"
 run_build --keep-images

tests/ci/pipeline-test.sh

@@ -97,6 +97,12 @@ for quality_workflow in "$workflow" "$release_workflow"; do
       exit 1
     }
   done
+  grep -Fq 'TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2' \
+    "$quality_workflow" || {
+      printf '%s does not pin the reachable Trivy vulnerability DB mirror\n' \
+        "$quality_workflow" >&2
+      exit 1
+    }
 done
 
 if [[ $(sed -n '/^      - name: Verify Go formatting$/,$p' "$workflow") != \