Add hab path

[sandhi18]

Description

This pull request updates the Grype vulnerability scanning workflows to provide greater flexibility and improve artifact management. The main changes include allowing a custom Habitat package path to be specified, updating the Grype scan process to use the CLI directly, and improving artifact naming and handling.

Grype scan workflow improvements:

• Added a new input grype-hab-path to .github/workflows/ci-main-pull-request.yml and .github/workflows/grype-hab-package-scan.yml to allow specifying a custom path to a built Habitat package, which overrides the default package inputs. [1] [2]
• Modified Habitat build steps in grype-hab-package-scan.yml (Linux, Windows, and Mac) to use the custom hab_path if provided, otherwise defaulting to the current directory. [1] [2] [3]
• Updated the usage of the shared workflow to reference a branch that includes the new hab_path support.
• Passed the new hab_path input to the shared workflow from the main workflow.

Direct Grype CLI usage and artifact handling:

• Replaced the use of the anchore/scan-action with direct Grype CLI commands, ensuring the latest Grype version is installed, and outputting both JSON and table-formatted scan results.
• Improved artifact naming by generating a unique name using the repository and timestamp, and uploading both the JSON and log output from the Grype scan.

Related Issue

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.