Supply expected checksum to contrib/install.sh

[kimxogus]

Description

contrib/install.sh verifies assets using checksum downloaded from trivy's github release.

When github repository is compromised, verifying with downloaded checksum is not safe because attacker can also manipulate checksum files in the github release asset, so I'd like to supply hardcoded checksum with trivy version so that we can verify if the asset is not changed.

I also hope this feature is applied to https://github.com/aquasecurity/setup-trivy either once it's implemented.

Verifying binaries with cosign also has a point(#10439), but I prefer this.

Target

None

Scanner

None