The manual grype install (cache + curl-pipe-sh + PATH export) is redundant
because anchore/scan-action already bundles grype internally. Removing it
also eliminates a supply chain risk: the install script was fetched from
the mutable @main branch of anchore/grype via curl | sh, in a job with
packages:write and id-token:write permissions.
76e1c17a24