fix(plugin): don't remove plugins when updating index.yaml file

[DmitriyLewen]

Description

Fixes plugin directory removal during index updates by changing the download strategy for index.yaml files. Previously, the plugin manager would use downloader.Download() which could inadvertently remove the entire plugin directory
during index updates.
See the following code:

trivy/pkg/downloader/download.go

Lines 58 to 60 in 8f5b560

	func Download(ctx context.Context, src, dst, pwd string, opts Options) (string, error) {
	// go-getter doesn't allow the dst directory already exists if the src is directory.
	_ = os.RemoveAll(dst)

This change ensures that installed plugins are preserved when updating the plugin index.

The fix implements a safer approach by:

• Downloading the index file to a temporary directory using downloader.DownloadToTempDir()
• Explicitly copying only the index.yaml file to the plugin directory using fsutils.CopyFile()

Examples:

Before:

➜ trivy plugin list
Installed Plugins:
  Name:    referrer
  Version: 0.3.1

➜ trivy plugin update
2025-08-20T12:35:54+06:00	INFO	[plugin] Updating the plugin index...	url="https://aquasecurity.github.io/trivy-plugin-index/v1/index.yaml"
➜ trivy plugin list  
No Installed Plugins

After:

➜ ./trivy plugin list
Installed Plugins:
  Name:    referrer
  Version: 0.3.1

➜ ./trivy plugin update
2025-08-20T12:38:36+06:00       INFO    [plugin] Updating the plugin index...   url="https://aquasecurity.github.io/trivy-plugin-index/v1/index.yaml"
➜ ./trivy plugin list  
Installed Plugins:
  Name:    referrer
  Version: 0.3.1

Related issues

• Close bug(plugin): trivy plugin update command removes installed plugins. #9357

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).