ci: pin runners to ubuntu-24.04 ahead of the ubuntu-latest move

.github/workflows/trivy.yml

@@ -30,7 +30,7 @@ concurrency:
 jobs:
   filesystem:
     name: Lockfile (including dev dependencies)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -95,7 +95,7 @@ jobs:
 
   published-image:
     name: Published image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
       contents: read