Fix vulnerabilities workflow for repositories with uppercase owner names

[reinvantveer]

Overview

Hello, we're running into CI run issues when using the setup provided as-is. Docker image references must be lowercase. The 'Check vulnerabilities' workflow used github.repository directly as the image tag, which fails on forks with uppercase characters in the owner name (e.g. the SPOTinfo org where this fork lives). This fix lowercases the repository name into IMAGE_NAME before building and scanning the image.

AI disclosure/proclaimer: this fix was requested by me (@reinvantveer) but the fix proposed by Claude Code Opus 5.5 through the JetBrains Junie agent (included as co-author in the commit). Everything was hand-checked by me and I assume full responsibility.

Related Issue / discussion

None, this is a small CI fix.

Additional information

Only .github/workflows/vulnerabilities.yml is changed.

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute bugfix (CI workflow) to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution
• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines