refactor(deps): Merge pkg/specs from trivy-policies into trivy

[simar7]

Description

Merge pkg/specs from trivy-policies into trivy and remove trivy's dependence on trivy-policies.

This PR is stacked onto #6005

Related issues

• Close refactor(misconf): Merging trivy-iac into Trivy #5626

Stacked PRs

• refactor(deps): Merge trivy-iac into Trivy #6005

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[nikpivkin]

Is there a need to upgrade the docker version? oras.land/oras-go is not compatible with this version.

[simar7]

After some further researching I don't think merging this in is a good idea at the moment. We will not eliminate the dependence of trivy on trivy-policies (which was one of the goals with this PR) and compliance specs to me feel a better fit to remain with the checks.

If things change in the future, we can reevaluate this decision.