fix(daily-scan): point Trivy at published artifact dependencies

[thpierce]

What

Point Trivy at the published artifact dependency tree (scan-target/) instead of scanning the full repo source at HEAD.

Why

Trivy was scanning scan-ref: '.', which:

• Picked up sample-apps/flask/requirements.txt — a sample app with urllib3 CVEs that are NOT in the published SDK
• Scanned source at HEAD, not the released version — a vuln fixed on main but present in the latest release gives a false negative

How

Changed scan-ref from '.' to 'scan-target/', which already contains requirements.txt from pip install aws-xray-sdk && pip freeze. Only runtime deps (wrapt, botocore) — no test or sample app deps.

Local validation

• Trivy: Parses requirements.txt, 0 vulns (clean — matches expected result since sample app urllib3 CVEs are correctly excluded)