Update CVE checks workflow to trigger on changes in 'infra/' directory

[Brijeshthummar02]

• [ ] Breaking change? (if so, please describe the impact and migration path for existing application instances)

fixes #958

CVE checks will now run only when infrastructure files change. The workflow won't trigger for unrelated application code changes. Notifications will work correctly for scheduled runs if CVE checks fail.

What changes did you make? (Give an overview)

Is there anything you'd like reviewers to focus on?

How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)

• [ ] No need to
• [x] Manually (please, describe, if necessary)
• [ ] Unit checks
• [ ] Integration checks
• [ ] Covered by existing automation

Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)

• [x] I have performed a self-review of my own code
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation (e.g. ENVIRONMENT VARIABLES)
• [ ] My changes generate no new warnings (e.g. Sonar is happy)
• [ ] I have added tests that prove my fix is effective or that my feature works
• [ ] New and existing unit tests pass locally with my changes
• [ ] Any dependent changes have been merged

Check out Contributing and Code of Conduct

A picture of a cute animal (not mandatory but encouraged)

[Brijeshthummar02]

@Haarolean what you think, good to go?

[Haarolean]

@Haarolean what you think, good to go?

not quite: It's the other way around - we need to run CVE checks only if the app's code is changed -- be it frontend or backend. So we need to think of list of paths to include here

[Brijeshthummar02]

@Haarolean what you think, good to go?

not quite: It's the other way around - we need to run CVE checks only if the app's code is changed -- be it frontend or backend. So we need to think of list of paths to include here

updated it any further changes needed?

[Brijeshthummar02]

@Haarolean Follow up on this PR.