feat(repo): add flags to pass credentials to any git hosting platform

[HarshitDhaduk]

Description

Scanning a private repository only worked for GitHub and GitLab, through the GITHUB_TOKEN and GITLAB_TOKEN environment variables. Repositories on Bitbucket, GitHub Enterprise, Gitea or a self-hosted server had no way to authenticate other than embedding credentials in the clone URL, which leaks them into the process list and shell history.

This adds --git-username and --git-password to the repository command, also settable as TRIVY_GIT_USERNAME / TRIVY_GIT_PASSWORD. Explicit credentials take precedence over the token env vars. The username falls back to the existing fanal-aquasecurity-scan dummy user, so token-based authentication works with --git-password alone.

The flags are git-prefixed because --username/--password already belong to the registry flag group, which the repository command also includes.

Before

$ trivy repo https://bitbucket.org/acme/private-repo
repository clone error: authentication required

There was no flag or environment variable that could authenticate this.

After

$ TRIVY_GIT_PASSWORD=<token> trivy repo https://bitbucket.org/acme/private-repo

or, with an explicit username:

$ trivy repo --git-username <user> --git-password <token> https://bitbucket.org/acme/private-repo

Resolves #6833

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user-facing change).

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}