fix: remove retired Docker Content Trust check

[Eljees]

Summary

• stop emitting CIS-DI-0005 and unregister the Docker Content Trust assessor
• remove the retired checkpoint metadata from scanner expectations and output examples
• mark trusted base-image verification as unsupported instead of recommending DOCKER_CONTENT_TRUST=1

Docker is retiring DCT/Notary v1, and Docker Official Image pulls can fail when DOCKER_CONTENT_TRUST=1 is set. The current INFO finding therefore recommends a setting that is no longer generally safe.

Reference: https://www.docker.com/blog/retiring-docker-content-trust/

Testing

• CGO_ENABLED=0 go test ./pkg/... (Go 1.26.3 container)

Fixes #289