Rework sbom creation and vulnerability detection in CI

[xopham]

After building harden.sh removes all apk folders and files to remove installer from container. However, trivy, grype, and syft use apk to detect installed binaries and consequently sbom creation and vulnerability scanning is false