Bump Trivy to v0.65.0

v0.63.0 properly detects SPDX licenses composed with AND and OR.

See: https://github.com/aquasecurity/trivy/releases/tag/v0.63.0

Author: cbandy

.github/actions/trivy/action.yaml

@@ -39,7 +39,7 @@ inputs:
       The value "skip" fetches no Trivy data at all.
 
   setup:
-    default: v0.62.1,cache
+    default: v0.65.0,cache
     description: >-
       How to install Trivy; one or more of version, none, or cache.
       The value "none" does not install Trivy at all.