feat(action): add image input to allow registry mirror overrides

[eightseventhreethree]

Description:

Adds an optional image input to the TruffleHog GitHub Action, defaulting to ghcr.io/trufflesecurity/trufflehog. Users in environments that require a registry mirror can override it without any change to default behavior.

Checklist:

• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Low risk: adds an optional input and threads it into the existing docker run invocation with a safe default, so behavior is unchanged unless explicitly configured.

Overview
Adds an image input to the GitHub Action so users can override the TruffleHog Docker image (e.g., to use a registry mirror) while still selecting the tag via the existing version input.

Updates the composite action to use ${IMAGE}:${VERSION} instead of a hardcoded ghcr.io/trufflesecurity/trufflehog:${VERSION}, and documents the new image option in the README.

^{Reviewed by Cursor Bugbot for commit 2c270c7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[eightseventhreethree]

Hey, @mustansir14 @kashifkhan0771 @MuneebUllahKhan222 anything else needed here? We have this as a real need.

[gugacyber]

The feature is useful and the default behavior is preserved, but line 102 has a shell injection risk: ${IMAGE} is unquoted in the docker run invocation. If a workflow passes image: "ghcr.io/evil/image --privileged", the extra tokens will be interpreted as additional flags by the shell before docker sees them.
Suggest quoting: "${IMAGE}:${VERSION}" — same fix that should apply to ${VERSION} and ${BASE} on the same line for consistency.