Add HTTP support for downloading HTTP

[knqyf263]

Description

Adding HTTP support for downloading DBs in addition to OCI. If the DB repository starts with http:// or https://, Trivy downloads DBs via HTTP as below.

$ trivy image --scanners vuln --db-repository https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz alpine:3.20

OCI and HTTP locations can be used together.

$ trivy image --scanners vuln --db-repository ghcr.io/aquasecurity/trivy-db:2 --db-repository https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz alpine:3.20

[orizerah]

@knqyf263
Is it possible to add authorization to this feature?

[knqyf263]

Since we found mirror.gcr.io, we need to discuss it again.

[tamirkiviti13]

Why is it related? How does it prevent the addition of HTTP support?

[knqyf263]

We planned to host the vulnerability database on GitHub Releases or things like that, and this feature was supposed to help since we needed to download it via HTTP. However, we found another OCI registry, and OSS users no longer need this feature.

We should discuss whether we should add this feature even if OSS users will not benefit from that.

[tamirkiviti13]

This issue suggests another option for downloading the DBs vuln, checks, etc.).
Why is it problematic to add the option? Won't OSS users might use this feature? For example, if they want to host their own DB instance but don't want to use OCI registry for that.
It is an addition and not a change of the current behavior.

[knqyf263]

All features are nice to have. But adding new features more or less increases maintenance costs. And it's hard to drop it once we add it.
We should consider whether the function is really necessary and how many people need it before adding it.