[Release-1.33] GHA + Testing Backports

[dereknola]

Proposed Changes

Backports of:

• Move to more secure trivy workflow based on labels, not comments #12592
• Add basic fuzz test + Enable codeql on GHA #12596
• Add retry around common timeout for hardened docker test #12601
• Remove K3s Binary GHCR cache #12602
• Migrate K3s Release Artifacts to GHA #12606

Types of Changes

Verification

Testing

Linked Issues

#12136

User-Facing Change

Further Comments

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 19.93%. Comparing base (03587fd) to head (fe877c8).
Report is 1 commits behind head on release-1.33.

❗ There is a different number of reports uploaded between BASE (03587fd) and HEAD (fe877c8). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (03587fd)	HEAD (fe877c8)
e2etests	1	0

Additional details and impacted files

@@                Coverage Diff                @@
##           release-1.33   #12608       +/-   ##
=================================================
- Coverage         40.71%   19.93%   -20.79%     
=================================================
  Files               187      184        -3     
  Lines             19313    19245       -68     
=================================================
- Hits               7864     3836     -4028     
- Misses            10256    14977     +4721     
+ Partials           1193      432      -761     

Flag	Coverage Δ
e2etests	?
unittests	19.93% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.