Feature/lab9

[03sano30]

Goal

Run security scans (Trivy + ZAP) on QuickNotes, triage findings, and fix at least one vulnerability.

Changes

• Added Trivy image, filesystem, and config scans
• Generated CycloneDX SBOM
• Added security headers middleware (X-Content-Type-Options, X-Frame-Options, CSP)
• Added unit test for security headers
• ZAP report before/after fix: 10021 (X-Content-Type-Options) removed

Testing

• ✅ Trivy scans completed (0 HIGH/CRITICAL in base image)
• ✅ ZAP before fix: 10021 present
• ✅ Headers verified with curl -v
• ✅ ZAP after fix: 10021 gone

Checklist

• Title is clear
• Commits are signed
• submissions/lab9.md updated