fix: use --pkg-types instead of deprecated --vuln-type

Trivy is deprecating the --vuln-type CLI option. The new option is --pkg-types; also TRIVY_PKG_TYPES
for environment configuration.