fix(api): bump Trivy to 0.70.0 in API image for CVE-2026-33186

- Patch gRPC-Go auth bypass (missing leading slash in HTTP/2 :path)
  also in the API container image, which bundles the same Trivy CLI
- Update SDK changelog entry to reflect both images are now covered

api/CHANGELOG.md

@@ -8,6 +8,10 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - New `scan-reset-ephemeral-resources` post-scan task zeroes `failed_findings_count` for resources missing from the latest full-scope scan, keeping ephemeral resources from polluting the Resources page sort [(#10929)](https://github.com/prowler-cloud/prowler/pull/10929)
 
+### 🔐 Security
+
+- `trivy` binary in the API image from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`)
+
 ---
 
 ## [1.26.1] (Prowler v5.25.1)

api/Dockerfile

@@ -5,7 +5,7 @@ LABEL maintainer="https://github.com/prowler-cloud/api"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.69.2
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1