Lab9 submission

[tdzdslippen]

Goal

Lab 9 — scan QuickNotes with Trivy (image/fs/config + SBOM), run OWASP ZAP baseline, triage findings, and fix missing security headers in code.

Changes

• submissions/scans/ — Trivy reports, CycloneDX SBOM, ZAP before/after JSON+HTML.
• app/security.go + app/security_test.go — SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options, CSP, COOP, CORP, Referrer-Policy) on all routes.
• app/main.go — wraps the router with the middleware.
• submissions/lab9.md — triage tables + design answers.
• Includes Lab 6 Dockerfile / compose.yaml as the scan/build baseline.

Testing

• Trivy 0.59.1: distroless layer clean; 11 HIGH stdlib CVEs triaged as WATCH; fs/config clean.
• ZAP 2.16.0 baseline: before — alerts 10021 + 90004; after rebuild — both gone; unit tests assert headers on /health, /notes, /metrics.

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/labN.md updated