PF-2417 Sanitize composite actions (and some cleanup)

[jasaltvik]

This PR sanitizes inputs/json in our composite actions.

This includes all composite actions under the actions directory.

---

Other changes:

• Remove ${{ }} from if statements as they are unnecessary, and it is better to evaluate directly
• The biggest update here is in the SBOM action, where we use jq (already installed in the GitHub runner) to sanitize arguments before using them
• Remove extra whitespace
• Trivy scan input validation had a bug with broken step summary output because of line breaks
• The official ZAP scan action used within the zap-scan composite action does not have a scan_api input, so these were removed

---

Read https://github.com/felleslosninger/platform/blob/main/docs/pipeline/how-to/pipeline-testing.md on how to test. There is no specific section for composite actions testing, but you need to check where the action is used, and update the branch.

Test runs:

• TBA