ci: add ecr fallback for trivy db download

Author: margaretjgu

.mega-linter.yml

@@ -42,5 +42,11 @@ YAML_YAMLLINT_FILTER_REGEX_EXCLUDE: "(codegen/functional/test/fixtures/|node_mod
 
 COPYPASTE_JSCPD_CONFIG_FILE: .jscpd.json
 
+# trivy's default DB registries (mirror.gcr.io, ghcr.io) have been hitting
+# TOOMANYREQUESTS during vulnerability DB download. Add the AWS ECR Public
+# mirror as a third fallback (setting this overrides the defaults, so they're
+# listed explicitly too) since it draws from a separate rate-limit pool.
+TRIVY_DB_REPOSITORY: "mirror.gcr.io/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2"
+
 # shellcheck: warn only until active script work stabilises
 BASH_SHELLCHECK_DISABLE_ERRORS: true