Add scheduled scans of 5.x and 6.x images

[GROwen]

Motivation

Refactor the trigger for vulnerability scans based on the response from GitHub support and remove the dependency on AWX to trigger the scans.

Changes

1. Update the upload-sarif action to specify the ref and commit the scan results relate to
   • a caveat to this is that the commit will not always relate to the commit that the image was built at i.e. a breaking change on the head of 5.x will fail to build, meaning the commit used to build the image tagged 5.x and the head of the 5.x branch will no longer be the same
2. Adds the checkout action to look up the commit of the tag input
3. Adds specific workflows for the scheduled scans of 5.x and 6.x images

Related PRs

dpc-sdp/sdp-ansible-playbooks#176

[GROwen]

I'm choosing to checkout the main branch of this action so I can access the ref and sha outputs which haven't been released yet.

[nicksantamaria]

LGTM!