feat: add CS_IGNORE_UNFIXED variable for container scanning

As noted in #199 (closed), we're getting large numbers of unactionable container scanning vulnerabilities which simply lie around not being triaged. Attempt to reduce the noise somewhat by setting CS_IGNORE_UNFIXED to true so that only actionable vulnerabilities are reported.