test(k8s): add vuln-only and secret-only cases to Test_separateMisconfigReports

[no-hup]

Description

Test_separateMisconfigReports has carried two TODOs for a while:

// TODO: add vuln only
// TODO: add secret only

This adds both cases, reusing the existing deployOrionWithVulns, cronjobHelloWithVulns and deployLuaWithSecrets fixtures from the same file. Each case runs SeparateMisconfigReports with only the vulnerability (resp. secret) scanner enabled and pins the current routing: the workload assessment carries the resources, and the infra assessment is still emitted (empty) because shouldAddToReport includes both scanners. Test-only change, no behavior touched.

$ go test ./pkg/k8s/report/
ok  github.com/aquasecurity/trivy/pkg/k8s/report  (37 passed)

No linked issue: test-only addition answering an in-code TODO, per the trivial-change allowance in the contributing docs.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).