Add APK security reports

README.md

@@ -93,6 +93,7 @@ apk:packages          List built Alpine packages and dependencies
 apk:publish-check     Run lint, multi-arch build, package listing, and smoke test
 apk:publish-gitea     Publish built packages to the Gitea Alpine package registry
 apk:outdated          Check packaged upstream versions and release summaries
+apk:security-report   Generate Trivy and CycloneDX reports for built packages
 apk:shell             Open an Alpine package build shell in Docker
 apk:smoke             Install-test built packages from the local repository in Docker
 apk:test-install      Test README installation instructions in a fresh Alpine container
@@ -234,6 +235,20 @@ APK_UPDATE_CHECK_MODE=fail mise run apk:outdated
 When an update is available, the command also lists compact release-note
 summaries for every release between the packaged and latest versions.
 
+### Security Reports and Roadmap
+
+The [project review and development roadmap](docs/project-review.md) tracks
+release-reliability goals. Generate advisory Trivy and CycloneDX reports for
+built packages with:
+
+```sh
+ALPINE_PACKAGE=seaweedfs mise run apk:security-report
+```
+
+Reports are written to `packages/security-reports/` and are uploaded by CI for
+each selected package build. Local runs scan the newest compatible package set
+available in the signed local repository.
+
 ### Gitea Workflow
 
 `.gitea/workflows/build.yml` builds and publishes `v3.24`. Pull requests