ci(container): gate Grype only on fixable findings, and comment results on the PR (#12341)

.github/workflows/ui-container-checks.yml

@@ -90,6 +90,7 @@ jobs:
             objects.githubusercontent.com:443
             raw.githubusercontent.com:443
             grype.anchore.io:443
+            get.anchore.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -106,6 +107,7 @@ jobs:
             .github/actions/trivy-scan/**
             .github/actions/grype-scan/**
             .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             ui/CHANGELOG.md
             ui/changelog.d/**
@@ -136,8 +138,8 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
 
       - name: Scan UI container with Grype
         if: steps.check-changes.outputs.any_changed == 'true'