[Bug]: truncateString can produce invalid UTF-8 in vulnerability descriptions

[Abhineshhh]

Version

sbi version: main @ d9404ec
Go: 1.26.5

What happened?

truncateString in trivy.go slices by byte length (s[:maxLen-3]). Multi-byte UTF-8 sequences (for example emoji such as U+1F6A8 🚨, which is 4 bytes) can be cut mid-rune, producing invalid UTF-8 stored in the database and emitted in JSON reports.

Proven (emoji, 4-byte UTF-8):

• Input starts with U+1F6A8 (bytes F0 9F 9A A8)
• truncateString(input, 4) yields a partial code unit sequence → utf8.ValidString is false

Expected: Rune-safe truncation that never emits invalid UTF-8 (cut only on rune boundaries; keep a max byte budget including ...).

Steps to reproduce

1. Unit test: call truncateString with a string starting with a 4-byte emoji and maxLen that lands inside the rune (e.g. 4, 5, or 6).
2. Assert unicode/utf8.ValidString(result) — currently fails.
3. Same class of failure for any multi-byte UTF-8 text (accented Latin, CJK, etc.).

Relevant log output

maxLen=4 → invalid UTF-8 (partial emoji code unit)
maxLen=5 → invalid UTF-8
maxLen=6 → invalid UTF-8
maxLen=7 → valid (full emoji + ellipsis handling depending on budget)