ci(container): gate Grype only on fixable findings, and comment results on the PR (#12341)

.github/workflows/api-container-checks.yml

@@ -84,6 +84,7 @@ jobs:
             raw.githubusercontent.com:443
             objects.githubusercontent.com:443
             grype.anchore.io:443
+            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -113,6 +114,7 @@ jobs:
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**
             .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             api/docs/**
             api/README.md
@@ -150,8 +152,8 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
 
       - name: Scan container with Grype
         if: steps.check-changes.outputs.any_changed == 'true'