As noted in #199, we're getting large numbers of unactionable container
scanning vulnerabilities which simply lie around not being triaged.
Attempt to reduce the noise somewhat by setting CS_IGNORE_UNFIXED to
`true` so that only *actionable* vulnerabilities are reported.

feat: add CS_IGNORE_UNFIXED variable for container scanning

See merge request !282