Expose which CVEs are present in every image

[friedrichg]

Describe the bug
Cortex uses alpine as the base image.
This image tends to have a number of CVEs associated, not related directly to cortex

Expected behavior
It should be possible for users/maintainers to check which CVEs are present in each release (at least)

Additional Context
The community should be aware of #5155 as quick as possible

[alvinlin123]

In https://quay.io/repository/cortexproject/cortex?tab=tags there is a column of the result of security scan; not sure if it's enough though. I wonder if GitHub has feature to expose image scan result as a badge.

[friedrichg]

@alvinlin123 I think if we link that somewhere in the docs we should be covered.

On a related thought, we might also switch to https://github.com/GoogleContainerTools/distroless and simplify our lifes