deployment/docker/Makefile: added docker-scan (#2916)

* deployment/docker/Makefile: added docker-scan

docker-scan based on native 'docker scan' function that use snyk.io, see https://docs.docker.com/engine/scan/

* set to call 'docker-scan after release binaries but before publishing

Makefile

@@ -73,7 +73,7 @@ vmcluster-crossbuild: \
 	vmcluster-freebsd-amd64 \
 	vmcluster-openbsd-amd64
 
-publish: \
+publish: docker-scan \
 	publish-vminsert \
 	publish-vmselect \
 	publish-vmstorage

deployment/docker/Makefile

@@ -16,6 +16,9 @@ package-base:
 			--tag $(BASE_IMAGE) \
 			deployment/docker/base
 
+docker-scan: package-base
+	docker scan --accept-license $(BASE_IMAGE) || (echo "❌ The build has been terminated because critical vulnerabilities were found in $(BASE_IMAGE)"; exit 1)
+
 package-builder:
 	(docker image ls --format '{{.Repository}}:{{.Tag}}' | grep -q '$(BUILDER_IMAGE)$$') \
 		|| docker build \