Discuss SSDF related requirements for containers

[smlambert]

This is an umbrella issue is to outline SSDF (Secure Software Development Framework) requirements, assess what is already being done upstream in terms of scanning and security, determine any gaps that remain, and then design a best path forward for the project. On-going maintenance burden and approach for handling changes and schedules in the underlying base image need to also be considered.

Related: adoptium/adoptium#120, #260

[jerboaa]

#275 is another sighting of this.

[smlambert]

#260 (comment) as relevant comment from a linked draft PR.